Next.js Edge Middleware & Session Gatekeeper

### Production `middleware.ts` Implementation ```typescript import { NextResponse } from 'next/server'; import type { NextRequest } from 'next/server'; import { jwtVerify } from 'jose'; const SECRET_KEY = new TextEncoder().encode(process.env.JWT_SECRET_KEY || 'default-dev-secret'); const PROTECTED_PREFIXES = ['/dashboard', '/workbench', '/settings']; export async function middleware(request: NextRequest) { const { pathname } = request.nextUrl; // 1. Check if path requires authentication const isProtected = PROTECTED_PREFIXES.some((prefix) => pathname.startsWith(prefix)); if (isProtected) { const token = request.cookies.get('session_token')?.value; if (!token) { const loginUrl = new URL('/login', request.url); loginUrl.searchParams.set('returnTo', pathname); return NextResponse.redirect(loginUrl); } try { // Edge-compatible JWT verification using Web Crypto (jose) await jwtVerify(token, SECRET_KEY); } catch (err) { // Expired or invalid signature const loginUrl = new URL('/login', request.url); loginUrl.searchParams.set('returnTo', pathname); const response = NextResponse.redirect(loginUrl); response.cookies.delete('session_token'); return response; } } // 2. Attach Strict Security Headers const response = NextResponse.next(); response.headers.set('X-Frame-Options', 'DENY'); response.headers.set('X-Content-Type-Options', 'nosniff'); response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin'); response.headers.set('Strict-Transport-Security', 'max-age=63072000; includeSubDomains; preload'); return response; } export const config = { matcher: ['/((?!_next/static|_next/image|favicon.ico|api/webhooks).*)'], }; ```