Deprecate middleware-based auth gating: shared notice + multi-SDK protect-pages#3404
Deprecate middleware-based auth gating: shared notice + multi-SDK protect-pages#3404jacekradko wants to merge 3 commits into
Conversation
… make protect-pages multi-SDK Adds docs/_partials/middleware-auth-deprecation.mdx as the single source of truth for the deprecation notice, and reworks protect-pages into a multi-SDK guide (Next.js base covering page/route handler/Server Action/layout protection with the layout re-render caveat; existing Nuxt content moved to protect-pages.nuxt.mdx).
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Strip the exploit-level language (normalize/percent-encoding/extra path
segment/authorization bypass) from the shared partial and the protect-pages
'Why not protect in middleware?' section, pending the unpublished advisory.
Keep the honest non-security motivation: middleware route matching is a
second model of your routes that drifts out of sync. Posture wording
('deprecated') unchanged here; that is part of the partial redraft under review.
Partial: soften posture to 'no longer recommended' (SDK has not shipped @deprecated), lead with the re-file/locality story, keep clerkMiddleware() explicitly blessed for non-auth work. Document the Gate 1/Gate 2 toggles. protect-pages: add a 'Migrating from middleware checks' section, before/after for a single matcher, a requireUser() helper for subtrees, the add-first remove-last ordering for the protect-all inversion (with a fail-open warning), and onward links. auth.protect() return shape verified against clerk/javascript.
|
Heads up: this PR is part of the #3426 carries a reframed, positive-recommendation version of the shared Keeping |
|
Superseded by #3426. The shared |
2 participants
First in a stacked series moving Clerk away from middleware-based auth gating (
createRouteMatcherand auth checks insideclerkMiddleware) toward protecting close to the resource. Background: Deprecate middleware-based auth checks.Foundation only: a shared
_partials/middleware-auth-deprecation.mdxthat holds the deprecation wording in one editable place (it's included everywhere downstream), andprotect-pagesreworked into a multi-SDK guide. The new Next.js base covers page, route handler, Server Action, and layout protection, and flags that a layout check isn't a security boundary because layouts don't re-render on soft navigation. The existing Nuxt content moved verbatim toprotect-pages.nuxt.mdx; it gets rewritten in the Nuxt PR.One thing worth a look: the partial uses full-strength "deprecated" wording even though the SDK hasn't shipped
@deprecatedyet. It's isolated to that one file so softening it later is a one-line change.