{
  "id": 17222637,
  "title": "Middleware is not your auth layer (a Next.js footgun I keep finding)",
  "url": "https://urgent.news/2026/10/30/middleware-is-not-your-auth-layer-a-next-js-footgun-i-keep-finding",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-30T12:23:38.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/somnath_khadanga_2e5c2364/middleware-is-not-your-auth-layer-a-nextjs-footgun-i-keep-finding-2n31"
  },
  "original_language": "en",
  "account": null,
  "summary": "The article discusses a common issue found in Next.js applications, where routes are protected using middleware.ts, but the API route handlers often trust the middleware and do not perform their own authentication checks. This can be exploited if the middleware is skipped due to a misconfigured matcher, refactor, or by calling the API directly. To prevent this, the author recommends implementing server-side checks for user sessions and roles within each handler that handles user data. Additionally, the article highlights the importance of hiding the admin dashboard in React when the user role does not match the required role, as this is UI gating and not access control. The final piece of advice is to always verify session revocation by making a request with an old cookie and checking if it still works, ensuring that the security boundary is indeed the handler.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}