What is Middleware / proxy?
Code that runs before every page loads, often to redirect signed-out visitors. Useful, but not enough on its own.
Where Middleware / proxy goes wrong in real apps
Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.
Who may see what · 4 minutes · Pro
The redirect that let them in
Your middleware sends signed-out visitors to the login page. A security advisory says one extra header can skip middleware entirely.
Read the fixIs middleware enough to protect my pages?
No. Middleware is a useful place for redirects, but it is a single layer, and framework bugs have allowed requests to skip it. Check authorization again wherever data is read: in server pages, route handlers and database rules. Keep your framework patched.
The life of a click · 4 minutes · Pro
Logged out after an hour
Users fill in a long form, press Save, and get 'Unauthorized'. It always happens about an hour after they signed in.
Read the fixWhy do my users get logged out after an hour?
Access tokens are short-lived, often about an hour, and must be renewed with a refresh token. If nothing refreshes the session before requests, especially on server-rendered pages that cannot set cookies, users see 'Unauthorized'. Refresh the session in code that runs before each request.
Getting paid · 4 minutes · Pro
The webhook that failed every time
Payments work. Upgrades don't. Stripe's dashboard shows every webhook to your app failing with a 400.
Read the fixWhy does Stripe webhook verification fail?
The signature covers the exact raw bytes Stripe sent. It fails when your code parses the body as JSON before verifying, or when it uses the wrong signing secret. In Next.js App Router, read the body with request.text() and pass it unchanged to constructEvent. Each endpoint, including the Stripe CLI, has its own whsec_ secret.
Related terms
- Request
- A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
- Endpoint
- One specific address on your server that does one job, like /api/invoices. Each one needs its own safety checks.
- Server
- A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
- Authentication
- Checking who someone is, usually by signing in.
- API
- The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.
- Response
- The server's reply to a request: the data, plus a status code saying whether it worked.