Middleware is not your auth layer (a Next.js footgun I keep finding)
When I audit Next.js apps built quickly (often with AI tools), one pattern shows up more than any other: routes are protected in middleware.ts , and the API route handlers trust that. // app/api/admin/users/route.ts export async function GET ( request : NextRequest ) { // "middleware already checked" const users = await db . user . findMany () return NextResponse . json ( users ) } Middleware can…
The article discusses a common issue found in Next.js applications, where routes are protected using middleware.ts, but the API route handlers often trust the middleware and do not perform their own authentication checks. This can be exploited if the middleware is skipped due to a misconfigured matcher, refactor, or by calling the API directly.
To prevent this, the author recommends implementing server-side checks for user sessions and roles within each handler that handles user data. Additionally, the article highlights the importance of hiding the admin dashboard in React when the user role does not match the required role, as this is UI gating and not access control.
The final piece of advice is to always verify session revocation by making a request with an old cookie and checking if it still works, ensuring that the security boundary is indeed the handler.
Brief written by urgent.news from Dev.to's own syndicated text. Machine-written — may contain errors; check the original before relying on it.
