Stop gating pages on the *** cookie in proxy middleware

Shipped: June 15, 2026 at 7:58 PM UTC
Author: kamo
Commit: 3623af5

proxy.ts (Next middleware) redirected every page request with no *** cookie to /logout. Since the session id now lives in sessionStorage — which a document request cannot carry — every navigation after login bounced. Server-side page-auth is fundamentally incompatible with sessionStorage, so move it to the client: the proxy now only routes OTK hand-offs and enforces IP/host rules, and useUserInfo sends genuinely-unauthenticated users (no token at all) to /logout. APIs still resolve the token from X-***-Token, so no page serves sensitive data unauthenticated.

All changes

Like what you see shipping?

Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.

Start Free Forever View Pricing