{"record":{"id":"c68cc4b0804c8cf6","repo":"anomalyco/sst","slug":"cannot-set-protection-on-a-router-with-inline-ro","errorCode":null,"errorMessage":"Cannot set \"protection\" on a Router with inline routes. Use lazy routes instead.","messagePattern":"Cannot set \"protection\" on a Router with inline routes\\. Use lazy routes instead\\.","errorType":"exception","errorClass":"VisibleError","httpStatus":null,"severity":"error","filePath":"platform/src/components/aws/router.ts","lineNumber":1404,"sourceCode":"\n    if (args && \"ref\" in args) {\n      const ref = reference();\n      this.cdn = output(ref.cdn);\n      this.kvStoreArn = ref.kvStoreArn;\n      this.kvNamespace = ref.kvNamespace;\n      this.hasInlineRoutes = ref.hasInlineRoutes;\n      this._protectionMode = ref.protection;\n      registerOutputs();\n      return;\n    }\n\n    const hasInlineRoutes = args.routes !== undefined;\n    const protection = normalizeProtection();\n\n    if (hasInlineRoutes) {\n      protection.apply((p) => {\n        if (p.mode !== \"none\")\n          throw new VisibleError(\n            `Cannot set \"protection\" on a Router with inline routes. Use lazy routes instead.`,\n          );\n      });\n    }\n\n    const waf = createWaf();\n    const wafArn = waf?.arn;\n    const wafLogging = normalizeWafLogging();\n    createWafLogging();\n\n    let cdn, kvStoreArn, kvNamespace;\n    if (hasInlineRoutes) {\n      cdn = handleInlineRoutes();\n    } else {\n      const r = handleLazyRoutes();\n      cdn = output(r.distribution);\n      kvStoreArn = r.kvStoreArn;\n      kvNamespace = output(r.kvNamespace);","sourceCodeStart":1386,"sourceCodeEnd":1422,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/router.ts#L1386-L1422","documentation":"Router 'protection' (WAF-based CAPTCHA/challenge settings) only works with the lazy `.route()`/`.routeBucket()` API because protection is applied per-route at the edge. If you pass inline `routes` and also set protection with mode other than \"none\", the constructor throws to prevent an invalid configuration.","triggerScenarios":"`new Router(..., { routes: {...}, protection: { mode: \"captcha\" | \"challenge\" | ... } })` — inline routes combined with any non-none protection mode.","commonSituations":"Migrating an existing inline-routes Router to use WAF protection; copy-pasting protection args from a lazy-route example into an inline-routes config.","solutions":["Remove the inline `routes` object and define routes lazily with `.route()` / `.routeBucket()` so protection can be applied","Set `protection: { mode: \"none\" }` if you genuinely want inline routes without protection","Move the WAF/protection config onto the individual lazy route definitions"],"exampleFix":"// before\nconst router = new Router($app, \"Router\", {\n  routes: { \"/*\": { url: \"https://example.com\" } },\n  protection: { mode: \"captcha\" },\n});\n// after\nconst router = new Router($app, \"Router\", {});\nrouter.route(\"/*\", \"https://example.com\", {\n  protection: { mode: \"captcha\" },\n});","handlingStrategy":"validation","validationCode":"const routes = { \"/*\": { url: \"https://example.com\" } };\nconst protection = { mode: \"captcha\" } as const | undefined;\nif (routes && protection && protection.mode !== \"none\")\n  throw new Error(\"Cannot combine inline routes with protection; use lazy routes\");","typeGuard":"function usesInlineRoutesWithProtection(args: { routes?: unknown; protection?: { mode: string } }): boolean {\n  return args.routes !== undefined && !!args.protection && args.protection.mode !== \"none\";\n}","tryCatchPattern":"try {\n  router = new Router(ctx, \"Router\", args);\n} catch (e) {\n  if (String(e).includes('Cannot set \"protection\"')) {\n    // rebuild args without inline routes\n  }\n  throw e;\n}","preventionTips":["Decide up front: inline routes OR protection, never both","When WAF protection is needed, always use the lazy .route()/.routeBucket() API","Keep a lint rule/helper that validates Router args in one place"],"tags":["router","waf","config-validation","sst"],"backgroundTag":"incompatible-component-options","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}