Auth middleware protects all private routes

Unauthenticated access to private routes is OWASP A01 (Broken Access Control) — the top-ranked web application vulnerability. CWE-285 (Improper Authorization) and CWE-287 (Improper Authentication) both apply when any private page or API route is reachable without a valid session. In Next.js, a middleware file placed at an incorrect path is silently ignored by the framework — every route it was intended to protect is exposed, with no error and no indication anything is wrong.

Place middleware.ts at src/middleware.ts or the project root — not in subdirectories. Ensure the matcher covers every private prefix, and validate auth in individual API routes as defense in depth:

// src/middleware.ts (or root middleware.ts) — correct location
export const config = {
  matcher: ['/dashboard/:path*', '/settings/:path*', '/api/:path*']
}

export async function middleware(request: NextRequest) {
  const session = await getSession(request)
  if (!session) return NextResponse.redirect(new URL('/login', request.url))
}

// Also validate in each API route:
export async function GET(request: Request) {
  const session = await getSession(request)
  if (!session) return Response.json({ error: 'Unauthorized' }, { status: 401 })
}

Do not list private routes and assume middleware will catch all gaps — enumerate every API route that returns user-specific data and confirm each has an independent auth check.