Free tools Windows power users keep installed
One-click scans. No signup required.
Next.js Middleware is the wrong place to make the final authorization decision for sensitive data or actions. It can run a fast, cookie-based check and redirect a visitor early, but the authoritative check belongs next to the data or operation it protects. Next.js 16 renamed the convention from Middleware to Proxy, so the file and function that the older guides call Middleware now go by Proxy. This article keeps the older name in the headline because that is the term most developers still search for.
What changed: Middleware is now Proxy
In Next.js 16 the request-interception convention is written as proxy.ts or proxy.js. The older Middleware convention is deprecated under that name. Proxy runs before routes are rendered, and it can redirect, rewrite, modify headers, or send a response directly. Its job is request handling at the edge of your application, not authorization of individual resources.
As an Amazon Associate I earn from qualifying purchases.
Two migration details matter. Proxy defaults to the Node.js runtime, and the Edge Runtime is not supported for Proxy. If your authentication or session library depends on Edge-only assumptions, check its Node.js compatibility before you move the logic. These points come from the Next.js “Upgrading: Version 16” guide and the “Proxy” documentation, which was last updated February 27, 2026.
Three responsibilities that people mix up
Next.js separates three jobs that are often blurred together in auth code:
#1 Best Overall
- Authentication verifies who the user is.
- Session management tracks authentication state across requests.
- Authorization decides which routes and data that user may access.
A valid login or session does not automatically mean the user may see every record, belong to every tenant, or perform every action. Most of the problems people blame on Middleware come from treating a successful session check as if it were an authorization decision.
Optimistic checks versus secure checks
The Next.js authentication guide, last updated September 16, 2026, describes two kinds of checks that differ in where they read their information and how much trust they deserve.
Rank #2
- HTML CSS Design and Build Web Sites
- Comes with secure packaging
- It can be a gift option
| Check | Where session data comes from | Where it typically runs | Authority | Good for |
|---|---|---|---|---|
| Optimistic | Session information stored in a cookie | Proxy, which can run on every route, including prefetched routes | Fast pre-filter only; not authoritative for sensitive resources | Redirects for signed-out visitors, showing or hiding UI, role-based routing |
| Secure | Session information checked against the database | The Data Access Layer, Server Functions, and Route Handlers, at the operation itself | Authoritative permission decision | Sensitive reads, mutations, and record- or tenant-level permissions |
The guide advises reading only the cookie in Proxy for the quick check and avoiding database lookups there. Proxy runs broadly, so a database call on every request, including prefetches, adds latency and load for little security benefit. The heavier, authoritative check belongs where the protected data is actually touched.
Recommended Free Tools
Where the authoritative check belongs
Centralize authorization in a Data Access Layer
The guide recommends a Data Access Layer (DAL) that holds your authorization logic in one place. Data reads and writes go through it, and it returns only the fields a given caller needs, usually shaped as Data Transfer Objects (DTOs). This keeps permission rules from being scattered across pages and components, and it stops a route from accidentally returning a full database record.
Rank #3
Protect each operation at its own boundary
Once the DAL exists, each operation that reads or changes sensitive data should check permissions at the server-side boundary responsible for it. A page that loads an invoice and a function that updates it both need the check, because each is reachable on its own.
Server Functions: the gap a matcher can open
Server Functions are POST requests sent to the route where they are used. That has a direct consequence: if a Proxy matcher excludes a path, it also excludes the Server Function calls made from that path. A matcher change, a route refactor, or a move of a component to another folder can silently change which requests Proxy sees, and nothing fails loudly when that happens.
Rank #4
- Brand: Wiley
- Set of 2 Volumes
- A handy two-book set that uniquely combines related technologies Highly visual format and accessible language makes these books highly effective learning tools Perfect for beginning web designers and front-end developers
The Next.js Proxy API reference states the rule directly: “Always verify authentication and authorization inside each Server Function rather than relying on Proxy alone.” In practice, each Server Function should confirm the session, confirm the permission for the specific record it touches, and reject the call if either check fails.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Route Handlers and APIs
Route Handlers follow the same logic. Check credentials and permissions before returning protected resources or performing sensitive mutations. The Next.js Backend for Frontend guide says explicitly not to rely on Proxy alone for authentication and authorization. If another client, such as a mobile app or a script, can reach the same endpoint, Proxy’s redirect behavior does nothing for it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What Proxy is good for
Proxy still has real work to do as an early, optimistic layer:
- Redirect unauthenticated visitors away from protected pages based on cookie session data.
- Route users based on request properties, such as the path or a header.
- Apply simple request and response header logic, or perform rewrites.
- Pre-filter requests before rendering, so the data and action layer handles the authoritative check.
The Next.js Proxy getting-started guide describes the limit clearly: “Proxy is not intended for slow data fetching. While Proxy can be helpful for optimistic checks such as permission-based redirects, it should not be used as a full session management or authorization solution.” Its role is to shape the first response, not to be the final gate.
Why the cookie check is not the last word
The Next.js authentication guide puts the point most plainly: “While Proxy can be useful for initial checks, it should not be your only line of defense in protecting your data.” A cookie-based redirect improves the experience for visitors who are obviously signed out. It does not prove that a request is authorized, and it cannot account for permissions that depend on the specific record being accessed.
Choosing an authentication library
The Next.js guide recommends using an authentication library for security and simplicity, and it describes features such as session management and multi-factor authentication. Whatever you choose, confirm that it supports the Node.js runtime that Proxy uses by default, and that its session checks can run both in Proxy and in the DAL without duplicating logic.
What the evidence does and does not establish
The official Next.js documentation sets out architectural guidance and quotable warnings. It does not publish quantitative data on vulnerabilities, failures, or performance costs caused by Middleware-based authorization, so this article makes no numerical claim about how often such failures occur. The argument rests on the separation of responsibilities, the coverage limits of Proxy, and the documented behavior of Server Functions.
Quick Recap
A practical checklist
- Keep Proxy checks cookie-based and free of database calls.
- Put authorization in a Data Access Layer and return DTOs with only the required fields.
- Check the session and the permission inside every Server Function.
- Check credentials inside every Route Handler that returns protected data or changes state.
- Review Proxy matchers whenever routes move, and confirm that Server Function POST requests are still covered by the logic that needs them.
- Confirm that your auth library runs on the Node.js runtime before migrating from Middleware.
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
