Tag
security
3 posts
7 min read
Next.js Between the Lines · Part 15
Auth Belongs Next to the Data, Not the Layout
Layouts do not re-render on client navigation, so an auth check there is not re-run. The Data Access Layer pattern puts the check where it cannot be skipped.
nextjssecurity
7 min read
Next.js Between the Lines · Part 14
From Middleware to Proxy, and Why
Next.js 16 renamed middleware.ts to proxy.ts. The rename is a recommendation: use it less, and never as your only authorization check.
nextjssecurity
6 min read
Next.js Between the Lines · Part 13
Every Server Action Is a Public Endpoint
The use server directive leaves a POST route behind. What Next.js protects for you, what it does not, and why schema validation is not an authorization check.
nextjssecurity