Is it safe to have iron-session endpoint for login/logout and most importantly retrieving session data to client components?

It looks like it's done this way in official example of iron-session https://github.com/vvo/iron-session/blob/main/examples/next/src/app/app-router-client-component-route-handler-swr/session/route.ts

but when I try to ask chat GPT about it, then I get:

Fetching the session in a client-side component, while possible, might not be the most secure approach for sensitive information. Sessions are typically handled on the server-side to ensure greater security because client-side JavaScript can be accessed and manipulated by users.

In the example provided earlier, the session data is fetched in server-side code (using getServerSideProps), which is more secure as it runs on the server and doesn't expose sensitive information to the client.

However, in some scenarios where you might need to check session information on the client side (for example, to conditionally render UI components), you can fetch session data from the client-side using an API endpoint secured with authentication. This should be done cautiously and with proper validation to prevent unauthorized access to sensitive information.