Protected routes with middleware in NextJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when an unauthenticated user accesses a protected route?

Consider a Next.js app using middleware to protect routes under /dashboard. The middleware checks for a valid token cookie. What is the expected behavior when a user without a token tries to access /dashboard/profile?

NextJS

import { NextResponse } from 'next/server';

export function middleware(request) {
  const token = request.cookies.get('token')?.value;
  if (!token) {
    return NextResponse.redirect(new URL('/login', request.url));
  }
  return NextResponse.next();
}

export const config = {
  matcher: '/dashboard/:path*',
};

A The user is redirected to the /login page.

B The user is shown a 404 Not Found error.

C The middleware throws a runtime error due to missing token.

D The user sees the dashboard page content without restrictions.

💡 Hint

Think about what the middleware does when the token is missing.

The middleware checks if the token cookie exists. If not, it redirects the user to the login page, preventing access to protected routes.

📝 Syntax

intermediate

Identify the syntax error in this Next.js middleware code

Which option contains the correct syntax for accessing cookies in Next.js middleware?

NextJS

export function middleware(request) {
  const token = request.cookies.get('token')?.value;
  if (!token) {
    return NextResponse.redirect(new URL('/login', request.url));
  }
  return NextResponse.next();
}

A const token = request.cookies.get('token')?.value;

B const token = request.cookies['token'];

C const token = request.cookies.get('token');

D const token = request.cookies.token.value;

💡 Hint

Check the official Next.js middleware API for cookie access.

In Next.js middleware, cookies are accessed using request.cookies.get('name')?.value. Other options are either invalid or will cause runtime errors.

❓ state_output

advanced

What is the output when middleware allows access with a valid token?

Given this middleware, what will the user see when accessing /dashboard/settings with a valid token cookie?

NextJS

import { NextResponse } from 'next/server';

export function middleware(request) {
  const token = request.cookies.get('token')?.value;
  if (!token) {
    return NextResponse.redirect(new URL('/login', request.url));
  }
  return NextResponse.next();
}

export const config = {
  matcher: '/dashboard/:path*',
};

// Assume /dashboard/settings page returns <h1>Settings Page</h1>

A The user is redirected to /login.

B The user sees the <h1>Settings Page</h1> content.

C The user sees a blank page with no content.

D The middleware throws an error and the page does not load.

💡 Hint

What does NextResponse.next() do?

When the token exists, the middleware calls NextResponse.next(), allowing the request to continue and render the protected page.

🔧 Debug

advanced

Why does this middleware fail to protect the route?

Review this middleware code. Why does it fail to redirect unauthenticated users?

NextJS

import { NextResponse } from 'next/server';

export function middleware(request) {
  const token = request.cookies.get('token');
  if (!token) {
    NextResponse.redirect(new URL('/login', request.url));
  }
  return NextResponse.next();
}

export const config = {
  matcher: '/dashboard/:path*',
};

A The matcher pattern does not match the route correctly.

B The cookie access syntax is incorrect and throws an error.

C NextResponse.next() should be called before the redirect.

D The redirect response is not returned, so the middleware continues and allows access.

💡 Hint

Check if the redirect response is properly handled.

The redirect response must be returned to stop the middleware and redirect the user. Without return, the middleware continues and allows access.

🧠 Conceptual

expert

How does Next.js middleware improve protected route performance?

Which statement best explains how Next.js middleware enhances the performance of protected routes compared to client-side checks?

A Middleware caches protected pages on the client to speed up future loads.

B Middleware delays page rendering until client-side JavaScript verifies authentication.

C Middleware runs on the edge before the page loads, preventing unauthorized requests early and reducing client load.

D Middleware duplicates authentication logic on both server and client, increasing security checks.

💡 Hint

Think about where middleware runs in the request lifecycle.

Next.js middleware runs at the edge before the page is served, so it can block unauthorized requests early, saving bandwidth and improving user experience.