affaan-m/ECC · error

Forbidden

Error message

Forbidden

What it means

Illustrative pattern from the react-performance skill: after confirming a session exists, the server action verifies the actor is authorized for the target user (e.g. self or admin) and throws 'Forbidden' when the ownership/role check fails. It marks an authenticated but unauthorized caller.

Source

Thrown at skills/react-performance/SKILL.md:198

### Preload on hover/focus

Trigger `<link rel="preload">` or `import()` on hover so the bundle is in cache by the time the user clicks.

## 3. Server-Side Performance (HIGH)

### Authenticate Server Actions like API routes

Every `"use server"` function is a public endpoint. Authenticate AND authorize inside the action — never rely on the calling Client Component's gating.

```ts
"use server";
export async function deleteUser(formData: FormData) {
  const session = await getSession();
  if (!session?.user) throw new Error("Unauthorized");
  const targetId = String(formData.get("id"));
  if (session.user.role !== "admin" && session.user.id !== targetId) {
    throw new Error("Forbidden");
  }
  await db.user.delete({ where: { id: targetId } });
}
```

### `React.cache()` for per-request deduplication

```ts
import { cache } from "react";

export const getUser = cache(async (id: string) => {
  return db.user.findUnique({ where: { id } });
});
```

`React.cache` dedupes within a single request. Calling `getUser("1")` from three Server Components in the same render = one DB query.

### LRU cache for cross-request data

View on GitHub (pinned to d8409a4b08)

Solutions

1. Add role-based checks (admin/moderator) alongside the ownership check
2. Return a structured 403-style error the client can render without crashing
3. Audit every 'use server' action for missing authorization checks

When it happens

Trigger: Thrown at skills/react-performance/SKILL.md:198 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of affaan-m/ECC@d8409a4b08 (2026-08-26). Data as JSON: /api/errors/a5acbfc212f83af6. Report an issue: GitHub.