Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →A Next.js login redirect loop means two or more routing decisions keep sending the request between URLs—for example, a protected page sends an unauthenticated visitor to /login, then another rule redirects /login back to the protected page. The exact cause depends on your routes, auth logic, cookies, and Next.js version, so trace the browser’s redirect chain and find the first rule that sends the request back around.
For Next.js 16 and later, the request-interception convention is called Proxy and uses proxy.ts or proxy.js. In Next.js 15 and earlier, it is commonly called Middleware and uses middleware.ts or middleware.js. The functionality remains the same; use the documentation for your version. Next.js Proxy documentation
![Computer Networking Bible: [3 in 1] The Complete Crash Course to Effectively Design, Implement and Manage Networks. Including Sections on Security, Performance and Scalability](https://m.media-amazon.com/images/I/41H4YJnxKgL._SL160_.jpg)
As an Amazon Associate I earn from qualifying purchases.
What creates a login redirect loop?
A loop is a cycle in the application’s routing decisions: the destination of one redirect is evaluated by another rule that sends the request back into the cycle. It is not necessarily a special error reported by Next.js. For example, an unauthenticated request for /dashboard may be redirected to /login, while a second rule mistakenly treats /login as protected and redirects it to /dashboard.
Authentication examples in the Next.js documentation separate public routes from protected routes: unauthenticated visitors to protected routes go to /login, while an authenticated visitor who opens a public route can be sent to /dashboard. A route classified incorrectly, or a redirect destination that matches a rule pointing back to its source, can make those decisions cycle. Next.js authentication guide
#1 Best Overall
A missing or unrecognized session cookie can also keep an unauthenticated branch running. That is a possibility to check, not a diagnosis: the browser might not send the expected cookie, or the code that reads or decrypts it might not recognize the session.
Trace the redirect chain before changing code
- Record each request. In your browser’s developer tools, open the Network panel, enable preservation of the log if available, and reproduce the problem. Record each URL, its HTTP status, the next
Locationdestination, and whether the expected session cookie is sent with the request. - Find the first request to
/login. Identify which rule sent the browser there. Then inspect what happens on the next request to/login: does it load, or does another redirect send the browser elsewhere? - Check redirects in execution order. Inspect
redirects()innext.config.jsfirst, then Proxy or Middleware, then page or server-side code that may redirect during rendering. Next.js configuration redirects run before Proxy; Proxy runs before route rendering. A redirect that fires earlier may explain behavior that is not coming from the branch you are currently inspecting. Next.js Proxy file convention Next.jsredirectsconfiguration - Change one condition at a time. Once you have located the transition that sends the browser back into the cycle, fix that condition and repeat the same test. Avoid changing unrelated redirect rules together; doing so can obscure which change resolved the loop.
Compare the redirect layers
Several parts of a Next.js application can redirect, but they run in different contexts. Identify the layer responsible for each transition before changing its logic.
| Layer | Best suited for | What to inspect |
|---|---|---|
next.config.js redirects() |
Known path redirects and conditional redirects | Source and destination, conditions based on headers, cookies, or query values, and the configured permanent or temporary behavior. These redirects run before Proxy. Next.js redirects documentation |
| Middleware or Proxy | Request-dependent decisions, such as an optimistic authentication check | Matcher patterns, public and protected route conditions, session-cookie handling, and the redirect destination. Next.js Proxy documentation |
redirect() in rendering or handlers |
Redirects from Server or Client Components, Route Handlers, and Server Functions | Whether page or handler code redirects after Proxy has allowed the request. This API is distinct from NextResponse.redirect in Proxy. Next.js redirect() API |
Check public routes, protected routes, and destinations
Make sure login is actually public
Review the route conditions and confirm that /login is not included in the protected-route check that redirects unauthenticated requests to /login. Also inspect any other routes intended to remain accessible without a session, such as registration or password-recovery pages, if your application has them.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Make authenticated-user redirects point somewhere distinct
If authenticated visitors are redirected away from public pages, verify that the destination—for example, /dashboard—does not match a rule that sends them back to /login. Trace the destination through every redirect layer rather than checking only the first redirect.
Review the matcher
The matcher determines which paths invoke Proxy. Check whether it includes the login route and every redirect destination involved in the cycle, and whether any intended exclusions are working as expected. A broad or unintended match can bring a route into authentication logic that was meant for another set of paths. The Proxy documentation recommends targeting paths precisely. Next.js Proxy documentation
Verify the session cookie check
- Name: Confirm that the cookie name in the request matches the name the code reads.
- Presence: Check the Network panel for the cookie on the request that is being redirected—not only in browser storage.
- Scope: Review the cookie’s path and other settings that affect whether it is sent on the login and protected routes.
- Interpretation: Verify that the code that reads or decrypts the session recognizes the value and chooses the expected authenticated or unauthenticated branch.
Next.js documents reading a session cookie in Proxy and using the resulting session to decide whether to redirect. If the request lacks the expected cookie, or the session check does not recognize it, the unauthenticated redirect can continue to run. Next.js authentication guide
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose the right redirect mechanism
Use configuration redirects for known URL rules
Use redirects() in next.config.js for known path changes, including cases that depend on configured header, cookie, or query-value conditions. Next.js uses a 307 or 308 response depending on the configured permanent value. Because these rules run before Proxy, check them even when the code under investigation is in proxy.ts or middleware.ts. Next.js redirects documentation
Use Proxy for request-dependent checks
For a request-dependent decision such as an optimistic authentication check, Proxy can return a redirect with NextResponse.redirect. In Next.js 16 and later, the convention is proxy.ts or proxy.js; in Next.js 15 and earlier, check the Middleware reference for the conventions and runtime behavior applicable to your version. Current Proxy documentation specifies the Node.js runtime. The Next.js 15 Middleware reference says Middleware defaults to Edge and that Node.js runtime support is available as of v15.5, so verify the relevant documentation if your authentication library requires a particular runtime. Next.js Proxy documentation Next.js 15 Middleware reference
Best Value
- Used Book in Good Condition
Use redirect() in the context that needs it
The redirect() function is available in Server and Client Components, Route Handlers, and Server Functions. Its documented response behavior varies by context: 307 for ordinary use, 303 in a Server Action, and meta-tag redirect behavior during streaming. Do not assume a redirect in rendering or a handler is the same rule as a Proxy redirect. Next.js redirect() API
Retest both sides of the authentication flow
- With no valid session, open a protected page. Confirm that the request reaches the login page and stops redirecting.
- With a valid session, open a protected page and confirm it loads as intended.
- With a valid session, open a public page such as
/login. Confirm any redirect goes to a distinct destination and does not return to the login page. - Check the redirect chain and cookie on each request again, including any configuration redirect or rendering-layer redirect that may still run.
Proxy is appropriate for optimistic checks, but it should not be the application’s only authorization boundary. The Next.js authentication guide says, “Proxy is not intended as a full session management or authorization solution.” Keep the majority of security checks close to the data source, where access to the protected data can be enforced. Next.js authentication guide
Without the affected Next.js version, redirect chain, Proxy or Middleware code, matcher, authentication library, cookie settings, configuration redirects, and deployment context, no single cause can be established. Treat each item above as a diagnostic check against the requests your application actually makes.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
