I am trying to secure a ReactJS app with authentication and I would like to protect the different pages (of course). My only problem is that if I use protected routes with react-Dom-router, it is client side.

Can it be hacked and if so how can I improve the security?

Would it be possible with SSR and protecting the routes with something like ExpressJS?

Thanks, Henry