laravel-vue-spa | A Laravel-Vue SPA starter project template | State Container library

Bundling based on Auth You likely aren't bundling the javascript on the fly... You're transpiling and bundling long before the client visits your site, so no you shouldn't bundle when auth is passed. Bundling, transpiling, and minifying can be pretty resource intensive processes.

Isolation for Security You could isolate code to a specific javascript file, there's no reason why you need to have everything bundled in the same app.js file. Laravel Mix can produce multiple bundles based on your configuration.

However, there's really no point from a security standpoint since client side code should never contain anything sensitive and all authorizations for actions should be performed on the server.

Production Readability If you're worried about someone reading the client side code, minified javascript is incredibly hard to decipher since it's shrunk down and obfuscated. Production javascript should always be minified without source maps.

Your problem is your route definition: