My biggest complaint about Next.js middleware

TL;DR

The video discusses issues with Next.js middleware and session management for proper authentication on a VPS.

Transcript

so for those of you who watch my channel you know I've been trying to deploy nextjs to a VPS and one of the things I was playing around with was hooking in middleware to do some type of authentication checks to make sure that certain pages don't show depending on how I'm logged in and I'm using the database strategy so if I go down to next off you'... Read More

Key Insights

• 🧘 Next.js posits challenges when deploying applications, especially regarding session management and middleware integration.
• 🖤 The lack of support for database session strategies in NextAuth middleware significantly complicates authentication checks.
• 🥺 Middleware can lead to excessive calls for session data, resulting in performance inefficiencies that exceed the intended optimizations.
• 📟 Developers have a preference for integrating authentication and authorization checks directly within page components rather than abstracting them into middleware functions.
• 💻 Many developers find that the coupling of Next.js with Edge computing undermines traditional Node.js capabilities on VPS deployments.
• 👤 The ongoing exploration of alternative methods for user session retrieval highlights the dynamic decision-making necessary during development.
• 🦮 Authoring such detailed analyses helps illuminate personal experiences, potentially guiding others in similar development scenarios.

Questions & Answers

Q: What were the initial authentication strategies attempted in the Next.js setup?

The creator initially used a JWT session strategy but encountered difficulties with its refresh mechanism and session expiration. Subsequently, they switched to a database session strategy. However, they discovered that NextAuth did not support this strategy with middleware, leading to further complications when checking user sessions.

Q: Why did the author face errors when using Drizzle ORM with PostgreSQL on a VPS?

The author encountered errors related to the internals of using the PostgreSQL driver with Next.js middleware. Next.js appears to implement checks that limit the use of native Node.js libraries while running on an Edge deployment, which triggered an error when trying to access session data through the library being used.

Q: What is the advantage of colocating authorization checks with relevant pages according to the author?

The author argues that colocating authorization checks within related pages enhances code clarity and maintainability. By handling checks directly within the page layouts, developers can easily manage access control and verify user permissions without the added complexity and potential pitfalls introduced by middleware functions.

Q: How does the author feel about the complexity introduced by middleware in Next.js?

The author expresses dissatisfaction with the complexity that middleware introduces into their application. They believe that while middleware is positioned as a means to optimize request handling and efficiency, it ultimately obfuscates the relationship between authentication logic and the pages, leading to maintainability issues and the potential for exposing sensitive information.

Summary & Key Takeaways

• The creator explores issues faced while deploying a Next.js application on a VPS, specifically focusing on middleware for authentication and session checks.

• The transition from a JWT strategy to a database session strategy raises complications, particularly the lack of support for middleware in the NextAuth library when not using JWT.

• Concerns about performance and complexity arise, as middleware checks potentially complicate session information retrieval and authentication processes, suggesting a preference for simpler authorization checks directly linked to page components.