Free tools Windows power users keep installed
One-click scans. No signup required.
In Next.js 16, the request-level feature once called Middleware is now Proxy, and Proxy uses the Node.js runtime—not Edge. It can quickly inspect a cookie and redirect a visitor, but it is only an optimistic gate. Put authoritative authorization in a Data Access Layer (DAL) close to the data, and check permissions again inside every Server Function. “Zero latency” is an aspiration, not a result established by the official documentation.
What changed in Next.js 16?
Starting with Next.js 16, the file convention is proxy.ts or proxy.js, replacing the Middleware convention. Place it alongside app or pages, or under src when that is where the application structure lives. The feature can redirect or rewrite requests, modify request or response headers, and return a response directly. See the Next.js Proxy guide and Proxy API reference.
As an Amazon Associate I earn from qualifying purchases.
Proxy is not Edge in Next.js 16
Next.js 16 Proxy runs on Node.js; its runtime cannot be configured, and Edge runtime is not supported for Proxy. The version 16 upgrade guide says developers who need Edge runtime should continue using Middleware. This is a version-specific distinction: older Middleware guidance may describe Edge as the default, while Next.js 15.5 added stable Node.js runtime support for Middleware. Check the Next.js 16 upgrade guide when choosing a convention for a particular version.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What Proxy can—and cannot—do for authentication
Authentication establishes identity; session management tracks that authentication across requests; authorization decides what the identified user may access. Next.js recommends an authentication library for greater security and simplicity, with features such as social login, multifactor authentication, or role-based access control depending on the library. Its authentication guide distinguishes optimistic checks from secure checks:
#1 Best Overall
| Check | What it consults | Best fit |
|---|---|---|
| Optimistic | Session information in a cookie | Fast UI decisions and early redirects based on role or permission claims |
| Secure | Session data in the database | Sensitive data and actions that require authoritative access control |
Proxy is suited to the first kind of check. It can read a cookie and redirect an unauthenticated visitor before the route completes, reducing unnecessary rendering or letting the application show an appropriate public or sign-in route. The documentation is explicit: “Proxy is not intended for slow data fetching.” A database lookup on every request can add work, especially because Proxy may run for prefetched routes as well as ordinary navigation.
That makes Proxy useful as an early filter, including for static routes that share data between users, such as paywalled content, but not as the sole protection for that content. A cookie is useful for a quick decision; sensitive data still needs a secure check where it is fetched or changed. The authentication guide recommends centralizing authorization in a DAL, returning only the data a caller needs through Data Transfer Objects, and optionally using Proxy for optimistic checks.
Rank #2
Where to put authoritative authorization
Centralize data access checks in a DAL
Keep permission logic close to the data source. A DAL can verify the current session and the user’s access before retrieving or mutating protected records, then return a limited DTO rather than an unrestricted database object. This gives pages, components, and actions a shared place to enforce the same rule instead of relying on a route-level redirect.
Recommended Free Tools
Check every Server Function
Do not assume Proxy has already authorized a Server Function. Server Functions are POST requests to the route where they are used, not separate routes in the routing chain. If a matcher excludes a path, it can also exclude Server Function calls associated with that path. The Proxy reference therefore advises verifying authentication and authorization inside each Server Function. Treat a Proxy redirect as a usability optimization, not a security boundary for a mutation.
How Proxy fits into request handling
Proxy runs before route rendering. The documented order is configured headers and redirects, then Proxy, then rewrites and filesystem or dynamic routes. It can communicate with the application through request or response headers, cookies, rewrites, redirects, or the URL. Because Proxy is invoked separately from render code, do not depend on shared modules or globals to pass state into rendering; use the documented request/response mechanisms. The Proxy API reference describes the execution model.
Use matchers as route coverage, not as authorization
A matcher selects which paths invoke Proxy and which are excluded. That can reduce unnecessary work, but it also creates a coverage boundary that must be reviewed as routes and Server Functions change. An excluded asset or API path may be intentional; excluding a path containing a protected action does not make the action safe. Audit matcher patterns whenever a route or Server Function moves, and keep data-level checks regardless of matcher coverage.
Rank #4
A basic optimistic redirect
The Next.js authentication guide illustrates checking a cookie-backed session and redirecting an unauthenticated visitor to /login for a protected route. It also demonstrates excluding selected asset and API paths with a matcher. Read this as an early navigation decision, not proof that the matcher protects every underlying read or write. For a library-specific setup, the Next.js Learn guide demonstrates an Auth.js/NextAuth-style handler exported through proxy.ts; confirm the current library instructions for the versions you are using: Adding Authentication.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Deployment and performance expectations
Proxy works with self-hosting through next start, but is not supported for static exports; platform support can vary for adapters. Runtime choice and deployment target therefore matter: verify support for the specific Next.js version and hosting platform before relying on Proxy. The self-hosting guide covers deployment considerations.
The official documentation reviewed provides no latency benchmark for Proxy and no measured basis for a literal zero-latency claim. Actual response time depends on runtime and network placement and on the work performed by the request handler. Avoid database-backed session checks in a request-wide optimistic gate when they add avoidable work, but measure the deployed application under its own conditions before claiming a speed improvement.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
