diff --git a/projects/02_twitter_clone/06_milestone/code_milestone7_authentication/app/api/favorites/route.js b/projects/02_twitter_clone/06_milestone/code_milestone7_authentication/app/api/favorites/route.js
index 4b6ebc0..0e106ae 100644
--- a/projects/02_twitter_clone/06_milestone/code_milestone7_authentication/app/api/favorites/route.js
+++ b/projects/02_twitter_clone/06_milestone/code_milestone7_authentication/app/api/favorites/route.js
@@ -8,6 +8,13 @@ export async function GET(request) {
   // we can safely access user data here
   const session = await getServerSession();
 
+  if (!session?.user) {
+    return NextResponse.json(
+      { error: "Unauthorized - Please login to access this resource" },
+      { status: 401 }
+    );
+  }
+
   // Return user's favorite tweets from localStorage
   // In a real app, this would fetch from a database
   return NextResponse.json({
@@ -20,6 +27,13 @@ export async function GET(request) {
 export async function POST(request) {
   const session = await getServerSession();
 
+  if (!session?.user) {
+    return NextResponse.json(
+      { error: "Unauthorized - Please login to access this resource" },
+      { status: 401 }
+    );
+  }
+
   try {
     const body = await request.json();
 
@@ -41,6 +55,13 @@ export async function POST(request) {
 export async function DELETE(request) {
   const session = await getServerSession();
 
+  if (!session?.user) {
+    return NextResponse.json(
+      { error: "Unauthorized - Please login to access this resource" },
+      { status: 401 }
+    );
+  }
+
   try {
     const { searchParams } = new URL(request.url);
     const tweetId = searchParams.get("tweetId");