RCA — Login / Middleware Issue

Problem statement

After successful credential authentication the app did not redirect the user back to the original page. The sign-in flow produced a session cookie (Auth.js / NextAuth), JWT callback logged, but the session callback did not run and middleware outputs were absent. Pages that should be protected were accessible without authentication.

What we saw

• No console.log from middleware.ts (no startup output).
• Pages protected by middleware remained accessible without authorization.
• Correct credentials: signin POST returned set-cookie with an AuthJS session id, but UI showed nothing (no redirect).
• Wrong credentials: explicit credentials error displayed (expected).
• JWT callback logged (token created), but session callback never logged.

What we checked

• Server logs on dev start — middleware log absent.
• Network: signin /api/auth/callback/credentials returned set-cookie.
• Fetched /api/auth/session manually — session callback only executed when session was fetched (expected).
• Examined file locations: middleware was located in project root while app used src/ layout; moving it to src/middleware.ts fixed detection.
• Inspected imports: middleware file originally re-exported auth from server auth file which imported Prisma — that makes middleware not edge-safe.

Detailed root cause

Two related issues combined to cause the behavior:

1. Middleware discovery rule / path mismatch — Next.js only auto-detects middleware when it exists at one of the expected locations (/middleware.ts at project root or /src/middleware.ts). If your project uses src/ sources but middleware sits at the root (or vice-versa) Next won't load it.
2. Edge runtime compatibility / import chain — middleware runs in an edge-like runtime and must be edge-safe. Re-exporting the server auth module (which imported Prisma / PrismaAdapter) forced Node-only modules into the middleware bundle. The edge bundler either failed or skipped the middleware, resulting in no middleware execution and no logs.

Fixes applied

• Move middleware to the correct location (src/middleware.ts) to satisfy Next's discovery when the app uses src/.
• Make middleware edge-safe: avoid importing server-only modules (Prisma), and use getToken from next-auth/jwt or withAuth from next-auth/middleware. This prevents Node-only code entering the edge bundle.
• Keep server-side auth separate: keep auth.ts (NextAuth & PrismaAdapter) as a server-only module used by the API route /api/auth/[...nextauth].
• Ensure callback behavior: implement a redirect callback in NextAuth to return the homepage when callbackUrl is missing (fallback to baseUrl).

Edge-safe middleware (recommended)

// src/middleware.ts (edge-safe)
import { NextResponse } from "next/server";
import { getToken } from "next-auth/jwt";

export async function middleware(req) {
  const pathname = req.nextUrl.pathname;
  if (pathname.startsWith('/api/auth') || pathname.startsWith('/_next') || pathname.startsWith('/favicon.ico')) return NextResponse.next();
  const token = await getToken({ req, secret: process.env.NEXTAUTH_SECRET });
  if (!token) {
    const signInUrl = new URL('/api/auth/signin', req.url);
    signInUrl.searchParams.set('callbackUrl', req.url);
    return NextResponse.redirect(signInUrl);
  }
  return NextResponse.next();
}

export const config = { matcher: ["/((?!api/auth|_next|public|favicon.ico|.*\\.(?:png|jpg|jpeg|svg|gif|ico|css|js|map)).*)"] };

Redirect fallback in NextAuth

// inside auth.ts NextAuth options
callbacks: {
  async redirect({ url, baseUrl }) {
    if (!url) return baseUrl;
    if (url.startsWith('/')) return baseUrl + url;
    try {
      const u = new URL(url);
      if (u.origin === baseUrl) return url;
    } catch(e) {}
    return baseUrl;
  }
}

How we verified the fix

• Restart dev server and confirm middleware console.log appears on startup.
• Visit protected page → middleware redirects to /api/auth/signin?callbackUrl= with the correct callback URL.
• Sign in with correct credentials — POST returns set-cookie and browser follows 302 back to callback URL.
• GET to callback URL includes the session cookie; the protected page is accessible and session callback logs when the session endpoint or page requires the session.

Sequence of events

Immediate & follow-up

• ✅ Move middleware to the expected path (src/middleware.ts when using src/).
• ✅ Replace any middleware imports that pull server-only modules; use getToken or withAuth.
• ✅ Ensure NEXTAUTH_URL and NEXTAUTH_SECRET are set in .env.local, and enable NEXTAUTH_DEBUG=true while debugging.
• 🔁 Add an automated test that verifies unauthenticated requests are redirected to the signin page with callbackUrl.
• 🔒 Audit middleware imports across the repo to catch accidental server-only imports in edge code.

Key takeaways

• Next.js middleware has strict discovery rules — place it exactly where Next expects it (root or src/).
• Middleware runs in an edge-like runtime — avoid importing Node-only modules (Prisma, filesystem, native libs) into it.
• When using built-in NextAuth flows, prefer normal form POST / server redirect flows for automatic navigation, or handle redirect:false responses explicitly in client code.
• Use targeted console logs and NEXTAUTH_DEBUG to quickly identify which callbacks run (jwt vs session vs redirect).