Protecting routes only in middleware

What it is

Vercel’s postmortem: "We do not recommend Middleware to be the sole method of protecting routes in your application." Middleware cookie checks are an optimistic early redirect, not the final authorization.

How to check

1. Find server actions, route handlers and data-fetching functions that read user data. Each should verify the session itself.

How to fix

1. Add a session/role check inside each server action and route handler (defense in depth).

'use server';
export async function deleteProject(id: string) {
  const user = await requireUser();            // don't trust middleware alone
  const project = await db.project.findUnique({ where: { id } });
  if (project?.ownerId !== user.id) throw new Error('Forbidden');
  await db.project.delete({ where: { id } });
}

Sources

• Vercel: Postmortem on Next.js Middleware bypass ↗