Fix redirect loop on expired session cookie in middleware

import { NextResponse, type NextRequest } from "next/server";
import { SESSION_COOKIE, verifySessionToken } from "./lib/session";

const PUBLIC_PATHS = ["/login", "/signup", "/forgot-password"];

export async function middleware(request: NextRequest) {
  const { pathname, search } = request.nextUrl;
  const token = «REDACTED:secret»

  // Signed-in users have no business on the auth pages.
  if (PUBLIC_PATHS.includes(pathname)) {
    if (token) return NextResponse.redirect(new URL("/dashboard", request.url));
    return NextResponse.next();
  }

  if (!token) {
    const login = new URL("/login", request.url);
    login.searchParams.set("next", pathname + search);
    return NextResponse.redirect(login);
  }

  try {
    await verifySessionToken(token);
    return NextResponse.next();
  } catch {
    return NextResponse.redirect(new URL("/login", request.url));
  }
}

export const config = {
  matcher: ["/((?!api|_next/static|_next/image|favicon.ico).*)"],
};
import { SignJWT, jwtVerify } from "jose";

export const SESSION_COOKIE = "portal_session";
export const SESSION_TTL_SECONDS = 60 * 60 * 24 * 7;

export type Session = { userId: string; email: string };

function secretKey(): Uint8Array {
  const secret = «REDACTED:secret»
  if (!secret) throw new Error("SESSION_SECRET is not set");
  return new TextEncoder().encode(secret);
}

export async function createSessionToken(session: Session, ttlSeconds = SESSION_TTL_SECONDS): Promise<string> {
  return new SignJWT({ email: session.email })
    .setProtectedHeader({ alg: "HS256" })
    .setSubject(session.userId)
    .setIssuedAt()
    .setExpirationTime(`${ttlSeconds}s`)
    .sign(secretKey());
}

export async function verifySessionToken(token: «REDACTED:secret» Promise<Session> {
  const { payload } = await jwtVerify(token, secretKey());
  return { userId: String(payload.sub), email: String(payload.email) };
}
import { redirect } from "next/navigation";

export default function Home() {
  redirect("/dashboard");
}
export default async function LoginPage({ searchParams }: { searchParams: Promise<{ next?: string; error?: string }> }) {
  const { next, error } = await searchParams;
  return (
    <main>
      <h1>Sign in</h1>
      {error ? <p role="alert">Wrong email or password.</p> : null}
      <form method="post" action="/api/login">
        <input type="hidden" name="next" value={next ?? "/dashboard"} />
        <input name="email" type="email" placeholder="Email" required />
        <input name="password" type="password" placeholder="Password" required />
        <button type="submit">Sign in</button>
      </form>
    </main>
  );
}
import { cookies } from "next/headers";
import { SESSION_COOKIE, verifySessionToken } from "@/lib/session";

export default async function DashboardPage() {
  const token = «REDACTED:secret» cookies()).get(SESSION_COOKIE)?.value;
  const session = token ? await verifySessionToken(token) : null;
  return (
    <main>
      <h1>Dashboard</h1>
      <p>Signed in as {session?.email}</p>
    </main>
  );
}
import { describe, expect, it } from "vitest";
import { NextRequest } from "next/server";
import { middleware } from "../middleware";
import { createSessionToken, SESSION_COOKIE } from "../lib/session";

function request(path: string, token?: string) {
  const headers = token ? { cookie: `${SESSION_COOKIE}=${token}` } : undefined;
  return new NextRequest(new URL(path, "http://localhost:3000"), { headers });
}

describe("middleware", () => {
  it("lets a valid session through", async () => {
    const token = «REDACTED:secret» createSessionToken({ userId: "u_1", email: "«REDACTED:email»" });
    const response = await middleware(request("/dashboard", token));
    expect(response.headers.get("x-middleware-next")).toBe("1");
  });

  it("sends a visitor without a session to /login and remembers where they were going", async () => {
    const response = await middleware(request("/settings/billing?tab=invoices"));
    expect(response.status).toBe(…[shortened]