anomalyco/sst · error · VisibleError

Cannot set "protection" when routing through a Router. Set "

Error message

Cannot set "protection" when routing through a Router. Set "protection" on the Router component instead.

What it means

When the site is served through a Router, access-control (`protection`, e.g. CloudFront auth on function URLs) must be configured on the Router component, not the site. Setting `protection` alongside `route` is rejected so there is a single source of truth for who can access the distribution.

Source

Thrown at platform/src/components/aws/ssr-site.ts:1269

      });
    }

    function normalizeRoute() {
      const route = normalizeRouteArgs(args.router, args.route);

      if (route) {
        if (args.domain)
          throw new VisibleError(
            `Cannot provide both "domain" and "route". Use the "domain" prop on the "Router" component when serving your site through a Router.`,
          );

        if (args.edge)
          throw new VisibleError(
            `Cannot provide both "edge" and "route". Use the "edge" prop on the "Router" component when serving your site through a Router.`,
          );

        if (args.protection)
          throw new VisibleError(
            `Cannot set "protection" when routing through a Router. Set "protection" on the Router component instead.`,
          );
      }

      return route;
    }

    function normalizeEdge() {
      return output([args.edge, args.server?.edge]).apply(
        ([edge, serverEdge]) => {
          if (serverEdge)
            throw new VisibleError(
              `The "server.edge" prop is deprecated. Use the "edge" prop on the top level instead.`,
            );

          if (!edge) return edge;
          return edge;
        },

View on GitHub (pinned to a0bd20f762)

Solutions

Remove the `protection` prop from the site component args
Set `protection` on the `sst.aws.Router` component instead
Redeploy

Example fix

// before
new sst.aws.NextjsSite("Web", {
  path: "src",
  protection: { type: "aws_iam" },
  route: { router },
});
// after
const router = new sst.aws.Router("Router", {
  domain: "example.com",
  protection: { type: "aws_iam" },
});
new sst.aws.NextjsSite("Web", { path: "src", route: { router } });

Defensive patterns

Strategy: validation

Validate before calling

if (siteArgs.protection && siteArgs.route) {
  throw new Error('Set `protection` on the Router component instead of the site');
}

Try / catch

try {
  new sst.aws.NextjsSite("Web", args);
} catch (e) {
  if (String(e).includes('Cannot set "protection"')) console.error("Move protection to the Router");
  throw e;
}

Prevention

Configure protection only on the Router when using route-based serving
Keep site args minimal when a Router is in front
Add a config-lint step that rejects protection+route combos

When it happens

Trigger: An SSR site component args include both `protection: {...}` and `route: { router }`.

Common situations: Hardening a site by adding protection while the app was already routed through a Router; copying a protected-site example into a router-based config.

Related errors

AI-assisted analysis of anomalyco/sst@a0bd20f762 (2026-08-30). Data as JSON: /api/errors/41b92d18ccc058ed. Report an issue: GitHub.