In this tutorial you will learn how to handle client side auth routes in SPA mode with the correct security assumptions.

A UUID in the URL is not a lock. Check the session on the GET that returns the bytes, record who owns the file, and keep shared caches from storing it.

A step by step guide to add cookie based login to a SvelteKit app using hooks.server.ts, form actions and an HttpOnly session cookie.