Guard private routes with middleware, then check again on the server

One middleware.ts file redirects every signed-out visitor away from the dashboard, so the page components themselves never check who's asking.

Intermediate to advancedRead 6 minDoing: a couple of hours6 steps

▶ Start

What you'll have at the end

A matcher-scoped middleware redirect plus a second session check inside the Server Component or Server Action that actually touches the data

Before you start

You need

A private section of the app already redirects a signed-out visitor through one guard file, and it holds at least one screen and one action that read or change data only a signed-in account should reach.

Not covered

Building the session or sign-in flow itself: this assumes one already exists and only adds the guard's own scoping plus the real check next to the data.

Leans on

6 steps

Where to go next

Verify a Stripe webhook's signature from inside a Route Handler

the caller there is an outside service sending a signed payload, not a signed-in visitor, so the second check is a signature check instead of a session one.

Checked 25 Aug 2026

Part of the NextJS cookbook