Next.js Auth Checks Inside Suspense Boundaries Can Leak UI to Logged-Out Users

A subtle timing flaw in Next.js App Router can expose protected dashboard UI to unauthenticated users when auth checks are placed inside Suspense boundaries. Because React begins streaming layout elements and skeleton fallbacks before an async session check resolves, a logged-out visitor may briefly see navigation structure and UI components before a redirect fires. The vulnerability does not expose actual user data, but it can reveal app structure, feature names, or navigation sections intended to remain private. The fix is straightforward: move the authentication check above and outside any Suspense boundary so the redirect decision is made before streaming begins. This ensures nothing from the protected route reaches the browser until authorization has been fully resolved.