{"record":{"id":"41b92d18ccc058ed","repo":"anomalyco/sst","slug":"cannot-set-protection-when-routing-through-a-rou","errorCode":null,"errorMessage":"Cannot set \"protection\" when routing through a Router. Set \"protection\" on the Router component instead.","messagePattern":"Cannot set \"protection\" when routing through a Router\\. Set \"protection\" on the Router component instead\\.","errorType":"validation","errorClass":"VisibleError","httpStatus":null,"severity":"error","filePath":"platform/src/components/aws/ssr-site.ts","lineNumber":1269,"sourceCode":"      });\n    }\n\n    function normalizeRoute() {\n      const route = normalizeRouteArgs(args.router, args.route);\n\n      if (route) {\n        if (args.domain)\n          throw new VisibleError(\n            `Cannot provide both \"domain\" and \"route\". Use the \"domain\" prop on the \"Router\" component when serving your site through a Router.`,\n          );\n\n        if (args.edge)\n          throw new VisibleError(\n            `Cannot provide both \"edge\" and \"route\". Use the \"edge\" prop on the \"Router\" component when serving your site through a Router.`,\n          );\n\n        if (args.protection)\n          throw new VisibleError(\n            `Cannot set \"protection\" when routing through a Router. Set \"protection\" on the Router component instead.`,\n          );\n      }\n\n      return route;\n    }\n\n    function normalizeEdge() {\n      return output([args.edge, args.server?.edge]).apply(\n        ([edge, serverEdge]) => {\n          if (serverEdge)\n            throw new VisibleError(\n              `The \"server.edge\" prop is deprecated. Use the \"edge\" prop on the top level instead.`,\n            );\n\n          if (!edge) return edge;\n          return edge;\n        },","sourceCodeStart":1251,"sourceCodeEnd":1287,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/ssr-site.ts#L1251-L1287","documentation":"When the site is served through a Router, access-control (`protection`, e.g. CloudFront auth on function URLs) must be configured on the Router component, not the site. Setting `protection` alongside `route` is rejected so there is a single source of truth for who can access the distribution.","triggerScenarios":"An SSR site component args include both `protection: {...}` and `route: { router }`.","commonSituations":"Hardening a site by adding protection while the app was already routed through a Router; copying a protected-site example into a router-based config.","solutions":["Remove the `protection` prop from the site component args","Set `protection` on the `sst.aws.Router` component instead","Redeploy"],"exampleFix":"// before\nnew sst.aws.NextjsSite(\"Web\", {\n  path: \"src\",\n  protection: { type: \"aws_iam\" },\n  route: { router },\n});\n// after\nconst router = new sst.aws.Router(\"Router\", {\n  domain: \"example.com\",\n  protection: { type: \"aws_iam\" },\n});\nnew sst.aws.NextjsSite(\"Web\", { path: \"src\", route: { router } });","handlingStrategy":"validation","validationCode":"if (siteArgs.protection && siteArgs.route) {\n  throw new Error('Set `protection` on the Router component instead of the site');\n}","typeGuard":null,"tryCatchPattern":"try {\n  new sst.aws.NextjsSite(\"Web\", args);\n} catch (e) {\n  if (String(e).includes('Cannot set \"protection\"')) console.error(\"Move protection to the Router\");\n  throw e;\n}","preventionTips":["Configure protection only on the Router when using route-based serving","Keep site args minimal when a Router is in front","Add a config-lint step that rejects protection+route combos"],"tags":["ssr-site","router","protection","config-conflict"],"backgroundTag":"conflicting-props","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}