K
Kinde•2mo ago
0x7F

Next.js 15 + Kinde Auth – Protected routes not working after logout

Hey, I’m new to Next.js and I’m having the following issue: I integrated Kinde login into my app, and login itself works fine. Afterwards, I want my routes to be protected – meaning that after logout I shouldn’t be able to access my pages/routes anymore unless I’m logged in. The problem: Even after logging out, I can still access my other pages – which should not be possible. I followed a tutorial where the solution was to create a middleware.js in the lib folder with the following code: 
 
import { withAuth } from '@kinde-oss/kinde-auth-nextjs/middleware';
import { NextRequest } from 'next/server';

export default function middleware(req: NextRequest) {
  return withAuth(req, {
    isReturnToCurrentPage: true,
  });
}

export const config = {
  matcher: [
    '/((?!_next|[^?]*\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico|csv|docx?|xlsx?|zip|webmanifest)).*)',
  ],
};
 
import { withAuth } from '@kinde-oss/kinde-auth-nextjs/middleware';
import { NextRequest } from 'next/server';

export default function middleware(req: NextRequest) {
  return withAuth(req, {
    isReturnToCurrentPage: true,
  });
}

export const config = {
  matcher: [
    '/((?!_next|[^?]*\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico|csv|docx?|xlsx?|zip|webmanifest)).*)',
  ],
};
3 Replies
Koosha-Kinde
Koosha-Kinde•2mo ago
Hi, Thanks for reaching out

The issue is just how the middleware is set up. What’s going wrong - middleware.ts/js must live at the project root, not in lib/. If it’s inside lib/, Next.js never runs it, so your routes aren’t actually protected after logout. - Also, use the documented withAuth pattern (callback + options), not withAuth(req, options). To Fix: Create /middleware.ts at the project root (same level as app/ or pages/) 
// /middleware.ts
import { withAuth } from '@kinde-oss/kinde-auth-nextjs/middleware';

export default withAuth(
  async function middleware(req) {
    // Optional: inspect req.kindeAuth here
  },
  {
    isReturnToCurrentPage: true,
    // publicPaths: ['/', '/about'] // add any pages that should be accessible when logged out
  }
);

export const config = {
  matcher: [
    '/((?!_next|[^?]*\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico|csv|docx?|xlsx?|zip|webmanifest)).*)',
  ],
};
// /middleware.ts
import { withAuth } from '@kinde-oss/kinde-auth-nextjs/middleware';

export default withAuth(
  async function middleware(req) {
    // Optional: inspect req.kindeAuth here
  },
  {
    isReturnToCurrentPage: true,
    // publicPaths: ['/', '/about'] // add any pages that should be accessible when logged out
  }
);

export const config = {
  matcher: [
    '/((?!_next|[^?]*\\.(?:html?|css|js(?!on)|jpe?g|webp|png|gif|svg|ttf|woff2?|ico|csv|docx?|xlsx?|zip|webmanifest)).*)',
  ],
};
This is exactly how Kinde recommends protecting all routes (except Next internals and static files). - Use the built-in auth routes (if you haven’t already): 
// app/api/auth/[kindeAuth]/route.ts (App Router)
import { handleAuth } from '@kinde-oss/kinde-auth-nextjs/server';
export const GET = handleAuth();
// app/api/auth/[kindeAuth]/route.ts (App Router)
import { handleAuth } from '@kinde-oss/kinde-auth-nextjs/server';
export const GET = handleAuth();
- Use Kinde’s <LogoutLink /> or hit /api/auth/logout, and set KINDE_POST_LOGOUT_REDIRECT_URL to a public page (e.g., your homepage). After you move it - Restart the dev server so Next picks up the new middleware. - Test in an incognito window: 1. Visit a protected route → you should be redirected to login 2. Log in → you land on the intended page 3. Log out → visiting the protected route again should redirect to login If you want some pages to stay public while logged out, add them to publicPaths as shown above.

Let me know if this helps, Thanks
0x7F
0x7FOP•2mo ago
Hi, thank you so much for your long and detailed response! You’ve solved my problem — the issue was that I had placed the middleware inside the lib/ folder. (Strangely enough, in the tutorial it was also placed in lib/ and worked there, which confused me a bit.) I really appreciate that you took the time to help me out ❤️
Koosha-Kinde
Koosha-Kinde•2mo ago
Glad it worked, Thanks
Let us know if you have any other question. Thanks

Did you find this page helpful?