diff --git a/frontend/src/routes/(app)/+layout.svelte b/frontend/src/routes/(app)/+layout.svelte
index 3f3165a..aeaa256 100644
--- a/frontend/src/routes/(app)/+layout.svelte
+++ b/frontend/src/routes/(app)/+layout.svelte
@@ -2,16 +2,21 @@
   import { page } from '$app/state'
   import { goto } from '$app/navigation'
 
-  let { children } = $props()
+  let { children, data } = $props()
 
-  const navItems = [
+  const publicNav = [
     { href: '/', label: '시세' },
     { href: '/theme', label: '테마' },
     { href: '/kospi200', label: '코스피200' },
+  ]
+
+  const protectedNav = [
     { href: '/asset', label: '자산' },
     { href: '/autotrade', label: '자동매매' },
   ]
 
+  let loggedIn = $derived(data.loggedIn)
+
   async function logout() {
     await fetch('/logout', { method: 'POST', credentials: 'include' })
     goto('/login')
@@ -33,7 +38,7 @@
 
         <!-- 네비 링크 -->
         <nav class="flex items-center gap-1 flex-1">
-          {#each navItems as item}
+          {#each publicNav as item}
             <a
               href={item.href}
               class="px-3 py-1.5 rounded-md text-sm font-medium transition-colors
@@ -44,15 +49,37 @@
               {item.label}
             </a>
           {/each}
+          {#if loggedIn}
+            {#each protectedNav as item}
+              <a
+                href={item.href}
+                class="px-3 py-1.5 rounded-md text-sm font-medium transition-colors
+                  {isActive(item.href)
+                    ? 'bg-blue-600 text-white'
+                    : 'text-gray-300 hover:text-white hover:bg-gray-700'}"
+              >
+                {item.label}
+              </a>
+            {/each}
+          {/if}
         </nav>
 
-        <!-- 로그아웃 -->
-        <button
-          onclick={logout}
-          class="text-xs text-gray-400 hover:text-white transition-colors shrink-0"
-        >
-          로그아웃
-        </button>
+        <!-- 로그인/로그아웃 -->
+        {#if loggedIn}
+          <button
+            onclick={logout}
+            class="text-xs text-gray-400 hover:text-white transition-colors shrink-0"
+          >
+            로그아웃
+          </button>
+        {:else}
+          <a
+            href="/login"
+            class="text-xs text-gray-400 hover:text-white transition-colors shrink-0"
+          >
+            로그인
+          </a>
+        {/if}
       </div>
     </div>
   </header>
diff --git a/frontend/src/routes/(app)/+layout.ts b/frontend/src/routes/(app)/+layout.ts
index 6044c91..351aa0a 100644
--- a/frontend/src/routes/(app)/+layout.ts
+++ b/frontend/src/routes/(app)/+layout.ts
@@ -1,13 +1,9 @@
-import { redirect } from '@sveltejs/kit'
-
-// 인증 가드: 세션 유효하지 않으면 /login으로 리다이렉트
+// 로그인 상태 확인 (리다이렉트하지 않음 — 공개 페이지도 접근 가능)
 export async function load({ fetch }) {
   try {
     const res = await fetch('/api/auth/check', { credentials: 'include' })
-    if (!res.ok) throw redirect(302, '/login')
-  } catch (e) {
-    // redirect 재throw
-    if (e && typeof e === 'object' && 'status' in e) throw e
-    throw redirect(302, '/login')
+    return { loggedIn: res.ok }
+  } catch {
+    return { loggedIn: false }
   }
 }
diff --git a/frontend/src/routes/(app)/asset/+page.ts b/frontend/src/routes/(app)/asset/+page.ts
new file mode 100644
index 0000000..7ecc6f8
--- /dev/null
+++ b/frontend/src/routes/(app)/asset/+page.ts
@@ -0,0 +1,7 @@
+import { redirect } from '@sveltejs/kit'
+
+// 자산 페이지: 로그인 필요
+export async function load({ parent }) {
+  const { loggedIn } = await parent()
+  if (!loggedIn) throw redirect(302, '/login?next=/asset')
+}
diff --git a/frontend/src/routes/(app)/autotrade/+page.ts b/frontend/src/routes/(app)/autotrade/+page.ts
new file mode 100644
index 0000000..44d4051
--- /dev/null
+++ b/frontend/src/routes/(app)/autotrade/+page.ts
@@ -0,0 +1,7 @@
+import { redirect } from '@sveltejs/kit'
+
+// 자동매매 페이지: 로그인 필요
+export async function load({ parent }) {
+  const { loggedIn } = await parent()
+  if (!loggedIn) throw redirect(302, '/login?next=/autotrade')
+}
diff --git a/middleware/auth.go b/middleware/auth.go
index b735c93..22802ee 100644
--- a/middleware/auth.go
+++ b/middleware/auth.go
@@ -42,6 +42,7 @@ var publicPaths = []string{
 	"/api/news",
 	"/api/disclosure",
 	"/api/auth/check",
+	"/api/watchlist",
 	"/ws",
 }