Q29: How do unauthorized() and forbidden() handle access errors in Next.js 15?
Next.js 15 introduced native unauthorized() and forbidden() functions. Throwing unauthorized() renders the nearest unauthorized.js boundary (HTTP 401). Throwing forbidden() renders the forbidden.js boundary (HTTP 403).
Throwing Unauthorized Access Error
import { unauthorized } from 'next/navigation';
export default async function AdminPage() {
const session = await getSession();
if (!session) unauthorized(); // Renders unauthorized.js automatically
return <h1>Admin Panel</h1>;
}💡 unauthorized() halts rendering and renders the unauthorized.js boundary UI.
Key Takeaways
unauthorized()triggersunauthorized.js(401 status).forbidden()triggersforbidden.js(403 status).
Knowledge Check
Which boundary file is rendered when unauthorized() is invoked inside a Next.js 15 Server Component?