How does the generated authentication check work?

When auth is enabled, the middleware builds a list of your protected route prefixes and checks whether the request pathname starts with any of them. For a protected route it reads the auth-token cookie; if no token is present it clones the URL, sets the pathname to /login, adds a from search param with the original path, and returns a NextResponse.redirect.

What does the matcher config exclude?

The generated config exports a matcher that runs middleware on all paths except those starting with api (API routes), _next/static, _next/image, and favicon.ico. This keeps middleware off static assets and optimized images so it only runs where it matters. You can tighten or widen the matcher after generating.

Is the rate limiting fully implemented?

No. Enabling rate limiting adds a commented scaffold that reads the request IP and marks where to plug in your logic, suggesting a service like Upstash or Redis. Real rate limiting needs shared state across requests, which middleware alone cannot provide, so the tool leaves that integration to you.

Which security headers does it add?

Enabling "Add security headers" sets X-Frame-Options to DENY (anti-clickjacking), X-Content-Type-Options to nosniff (prevents MIME sniffing), and Referrer-Policy to strict-origin-when-cross-origin. When this option is on, the middleware returns a NextResponse.next() response object so the headers are attached to the outgoing response.

Where do I put the generated file?

Save it as middleware.ts in the root of your Next.js project (next to your app or pages directory, not inside them). Next.js automatically picks it up and runs it for every request that matches the exported matcher config.

Does the order of the features in the file matter?

Yes, and the tool handles it for you. Redirects (auth and www) use early returns so they short-circuit before other work, logging runs first, and header injection is applied to the final response object. The middleware ends by returning that response when headers are enabled, or NextResponse.next() otherwise.

Next.js Middleware Builder

Generate Next.js middleware for authentication, rate limiting, and more

About this ToolHow it works, benefits & use cases

Next.js middleware runs on every matching request before a page renders, which makes it the right place for auth gating, redirects, header injection, and logging — but the NextRequest/NextResponse API and the matcher config are easy to get wrong. This builder assembles a working middleware.ts from a checklist of features. Tick what you need — an authentication check that reads an auth-token cookie and redirects unauthenticated visitors to /login (with a from query param), a list of protected route prefixes, rate-limiting scaffolding, request logging, a www-to-non-www 301 redirect, security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy), and locale detection — and it emits typed middleware plus a matcher config that excludes API routes, _next assets, and favicon by default. The output is correctly ordered (early returns for redirects, a response object when headers are added) and ready to drop in your project root. Everything generates in the browser, and your selection is captured in a shareable URL.

How to Use

1Toggle "Authentication check" on if you want route protection; the redirect logic reads an auth-token cookie.
2When auth is on, manage "Protected Routes": type a path prefix (for example /admin) and press Enter or the plus button, removing any with the trash icon.
3Enable the other features you need — "Rate limiting", "Request logging", "Redirect www to non-www", "Add security headers", and "Locale detection".
4Click "Generate Middleware" to build the file.
5Copy or download the result as middleware.ts into your project root, or share your configuration via its URL.

Key Benefits

Generates a typed middleware.ts using NextRequest/NextResponse, not hand-written boilerplate
Auth check reads an auth-token cookie and redirects to /login with the original path as a from param
Protected routes are matched by prefix, so /dashboard also covers /dashboard/settings
Optional security headers: X-Frame-Options, X-Content-Type-Options, and Referrer-Policy
www-to-non-www 301 redirect, request logging, locale detection, and rate-limit scaffolding as toggles
Includes a matcher config that skips API routes, _next static and image assets, and favicon
Runs in the browser with a shareable URL that captures your selected features

Common Use Cases

Gating /dashboard, /profile, or /admin behind a session cookie
Adding baseline security headers across an entire Next.js app from one file
Forcing a canonical host by redirecting www to the apex domain
Logging method and pathname for every request during development
Bootstrapping a middleware skeleton you will extend with real rate limiting

Generated middleware.ts

Run to see the generated Next.js middleware.

Middleware Tips

Place middleware.ts in the root of your project
Middleware runs before every request
Use matcher config to limit which routes are affected
Keep middleware lightweight for better performance

Was this tool helpful?

Share Your Experience

Help others discover this tool!

Share on

Next.js Middleware Builder

How to Use

Key Benefits

Common Use Cases

Middleware Features

Middleware Tips

Was this tool helpful?

Share Your Experience

Related tools

Next.js Middleware Builder

How to Use

Key Benefits

Common Use Cases

Middleware Features

Middleware Tips

Was this tool helpful?

Share Your Experience

Related tools

Frequently Asked Questions - Next.js Middleware Builder