Can I use jsonwebtoken in Next.js middleware?

No. Middleware runs on the Edge Runtime, which does not support Node.js built-in modules like crypto. jsonwebtoken depends on Node crypto and fails. Use jose instead, which is Edge-compatible and officially recommended by Next.js.

How do I prevent redirect loops in Next.js middleware?

Exclude your login page and any public pages from the middleware matcher. If /login is behind auth middleware, redirecting to /login triggers another middleware check, which redirects again. This creates ERR_TOO_MANY_REDIRECTS.

Can I query the database from Next.js middleware?

Technically yes with Edge-compatible drivers, but you shouldn't. Middleware runs on every request and adds latency to every page load. Store the data you need (user ID, role) in the JWT. Refresh it separately when it expires.

What is the Next.js middleware matcher config?

The matcher is a config in middleware.ts that filters which routes middleware runs on. Without it, middleware runs on every request including static files. A typical matcher excludes _next/static, _next/image, favicon, and API routes to keep middleware fast.

Next.js Middleware for Auth — The Patterns That Actually Work

Next.js middleware is the worst-documented feature in the framework. The official docs show you a hello-world example, ship it, and discover in production that JWT verification fails, your users hit redirect loops, and half your database library doesn't work.

I've shipped middleware-based auth on three production apps. Here's the setup I use, after all the bugs.

The mental model

Middleware runs on every request before the route handler. It runs on the Edge Runtime by default, which is a restricted sandbox — no Node built-ins like crypto or fs. It's fast (cold start in milliseconds) but limiting.

// middleware.ts (in the root of your project, next to app/)
import { NextResponse } from 'next/server'
import type { NextRequest } from 'next/server'
 
export function middleware(request: NextRequest) {
  // Runs on every matched request
  return NextResponse.next()
}
 
export const config = {
  matcher: ['/dashboard/:path*', '/admin/:path*'],
}