The App Router is Next.js’s modern routing model for organizing application paths, layouts, and request handling. It decides how incoming requests map to pages, server components, and route handlers, so it sits close to the boundary between user input and server-side logic. In practice, that makes it more than a navigation feature: it is part of the application’s control flow.
In cyber security, that matters because mistakes in routing can affect authentication and outbound requests. If security checks are tied too closely to App Router middleware or rewrites, a flaw may let a request reach protected content without proper verification. If redirects or rewrites use request-controlled values, the server can be pushed into making unintended outbound requests, which is a common path to SSRF. Defenders should treat App Router logic as security-sensitive code, keep authorization checks on the server side, and strictly validate any dynamic route destinations.