Next.js Middleware for Auth and Route Protection — The Complete Pattern

Short summary

Next.js middleware runs at the edge and handles authentication before database/server logic, using JWT tokens with jose library for edge-compatible verification. Pass verified user context via headers to server components, set role-based access control, and implement rate limiting—but configure the matcher to avoid unnecessary overhead on static assets. The pattern includes production validation and covers common pitfalls like infinite redirect loops.

• •Middleware verifies JWT tokens at the edge and passes user context (ID, role) to server components via headers
• •Use jose instead of jsonwebtoken; standard JWT libraries don't run in edge runtime
• •Configure matcher strictly to avoid unnecessary overhead; implement rate limiting for API routes with Redis for multi-instance deployments

Generated with AI, which can make mistakes.