Skip to main content
UI Guides

Search rules

Search all UI Guides rules by name, category, or source

designRauno

Server-Side Auth Redirects

MUST

MUST: Redirect unauthenticated users on the server (302 before any HTML ships), not from a client-side effect — client redirects flash the protected page and jank the URL.

Authentication redirects should happen on the server to avoid janky client-side URL changes

Bad

Good

Why it matters

Client-side auth checks load the protected page first, then redirect to login after JavaScript executes — causing a visible flash of the wrong page and a jarring URL change. Server-side redirects (302) send users directly to the login page before any content loads.

References

Built by Gleb Stroganov, design engineer at Evil Martians.

The rules come from other people's skills and guidelines — Vercel, Rauno Freiberg, @Ibelick, impeccable, Emil Kowalski, Tailwind, RAMS — each one credited on the Sources page. The work here is extraction and wiring: every rule is pulled into one corpus, given a good and a bad example you can operate, a MUST/SHOULD/NEVER rule an agent can paste, and a link back to where it came from.