Next.js middleware: what belongs there and what definitely does not

What is Next.js middleware and when does it run?

Middleware is a single function in middleware.ts that runs before routing resolves, on every request matching its matcher config.

Because it runs before the cache and before rendering, it is the right place to decide where a request should go. Because it runs on every matched request, anything slow in it becomes latency added to your whole site.

// middleware.ts
import { NextResponse, type NextRequest } from "next/server";

export function middleware(request: NextRequest) {
  const token = request.cookies.get("session")?.value;
  if (!token && request.nextUrl.pathname.startsWith("/app")) {
    const url = new URL("/login", request.url);
    url.searchParams.set("next", request.nextUrl.pathname);
    return NextResponse.redirect(url);
  }
  return NextResponse.next();
}

export const config = {
  matcher: ["/app/:path*", "/account/:path*"],
};

What should you put in middleware?

• Redirect unauthenticated visitors away from private route prefixes based on cookie presence.
• Locale detection and rewriting from the Accept-Language header or a geo header.
• A/B test bucketing: read or set a cookie, rewrite to a variant path.
• Security headers and a per-request nonce for Content-Security-Policy.
• Legacy URL redirects during a migration, driven by a static map.
• Bot handling and simple blocklists.

What should never go in middleware?

1. 1Database queries. Every page view now waits on your database before rendering starts.
2. 2Full JWT verification with a remote JWKS fetch on every request — cache the key or verify in the route.
3. 3Business logic that belongs in a server component or route handler.
4. 4Large dependencies. The middleware bundle has tight size limits and edge runtimes lack many Node APIs.
5. 5Anything that must be correct for security. Middleware can be bypassed by misconfiguration; enforce authorisation where the data is read.

How do you get the matcher right?

Match the narrowest set of paths that need the logic, and always exclude static assets and image optimisation routes.

export const config = {
  matcher: [
    // Everything except static files, images, and metadata routes
    "/((?!_next/static|_next/image|favicon.ico|robots.txt|sitemap.xml|.*\\.(?:png|jpg|svg|webp)$).*)",
  ],
};

A broad matcher that includes _next/static means middleware runs for every JavaScript chunk and font file your page loads. On a page with 30 assets that is 30 unnecessary middleware invocations per visit — measurable in both latency and platform cost.

Rewrite or redirect?

For permanent URL changes during a site migration use a 308 (or 301) redirect so link equity transfers. Use a rewrite when two URLs should genuinely serve the same content and you do not want the visitor's URL to change.