Do we still need middleware?

[engin-can]

Does this snippet imply I don't need to use middleware for auth with with local strategy enabled?

export const authConfig: NextAuthConfig = {
  providers: [github],
  callbacks: {
    authorized: ({ auth }) => auth?.user && new Date() < new Date(auth.expires),
  },
};

[engin-can]

I am asking with relation toCVE-2025-29927. I no longer want to rely on middleware for auth...

[CrawlerCode]

You should not only use the middlware to protect your application. As mentioned in the Auth.js guide, you have several options to protect resources. You should protect your api routes, server components, server actions etc. separately. And bypassing the middleware has a small impact if you project your resources separately.

[CrawlerCode]

No, this does not imply that you do not need to use middleware. The local strategy is a Payload CMS feature and is absolutely unrelated to Auth.js. enableLocalStrategy: true only allows you to combine both strategies.

---

General, you don't need the middlware, using it is optional. Auth.js offers you various options and you can configure it according to your requirements, depending on your use case.

The benefit of the middleware are:

• keep the session alive
• protecting pages (if you specify an authorized callback)

If you don't want to do this, you don't need middlware.

[engin-can]

Ok, so that callback is used with the middleware. Thats what I was wondering. Thanks...