Some of you are ready for an argument, you responded to my post yet seemingly missed the very first sentence fragment:

>Not that this isn't a serious attack vector

At no point did I say or imply what you put in quotes.

The middleware should fetch auth, not check it. Each page should check the auth provided by the middleware. Skipping middleware wouldn't bypass anything in this case.

You don't do it everywhere. You do it in the source system. The Next.JS application should just be doing "sanity" checks and passing along identity information at most. That belongs in the middleware layer, but it's not authoritative.

If bypassing a middleware layer is the one "trust me bro" check you have in your web app, then lol.

That's actually really hilarious and you should tell me what company/website that's for so I can submit some bug bounties.