docs(richtlinien): document why prerender=true is auth-safe

handleAuth in hooks.server.ts is in the sequence() chain and redirects
unauthenticated users at runtime regardless of prerender. Adding a comment
so the next reader doesn't mistake this for a security hole. (Markus/Nora)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Marcel
2026-04-25 01:22:33 +02:00
parent 0b1d67ca96
commit d2cee2a5b4

View File

@@ -1 +1,6 @@
// prerender = true is safe here: hooks.server.ts exports
// handle = sequence(userGroup, handleAuth, ...)
// where handleAuth redirects all non-public paths to /login at runtime.
// Prerendered HTML is served, but the browser still hits handleAuth on
// every navigation — unauthenticated users are redirected before seeing content.
export const prerender = true;