Auth middleware is always a no-op — all routes unprotected at gateway level #3

New issue

Closed

opened 2026-05-09 00:26:11 +00:00 by Mark · 0 comments

Mark commented

2026-05-09 00:26:11 +00:00

Owner

Severity: High

File: src/middleware.ts (line 16-18)

Issue: The Clerk middleware (clerkMiddlewareHandler) is fully defined but the default export always calls noOpHandler(), which does nothing. This means no routes are protected at the Next.js middleware/gateway level. While individual API routes check auth(), this breaks defense-in-depth:

The /app/* route matcher is defined but never wired up
Static assets, pages, and any route gap could be accessible
The comment says "For now, always use noOpHandler to debug the issue" — this debug state appears to be permanent

Files affected: All routes under /app/* matcher pattern

Fix:

Remove the debug override and enable the Clerk middleware:
```
export default clerkMiddlewareHandler;
```

Or, if NO_AUTH mode is intentional:

export default process.env.NO_AUTH === "true" ? noOpHandler : clerkMiddlewareHandler;

If the Clerk middleware itself has a bug, investigate and fix rather than leaving all routes unprotected

## Severity: High **File:** `src/middleware.ts` (line 16-18) **Issue:** The Clerk middleware (`clerkMiddlewareHandler`) is fully defined but the default export always calls `noOpHandler()`, which does nothing. This means **no routes are protected at the Next.js middleware/gateway level**. While individual API routes check `auth()`, this breaks defense-in-depth: - The `/app/*` route matcher is defined but never wired up - Static assets, pages, and any route gap could be accessible - The comment says "For now, always use noOpHandler to debug the issue" — this debug state appears to be permanent **Files affected:** All routes under `/app/*` matcher pattern **Fix:** 1. Remove the debug override and enable the Clerk middleware: ```typescript export default clerkMiddlewareHandler; ``` 2. Or, if NO_AUTH mode is intentional: ```typescript export default process.env.NO_AUTH === "true" ? noOpHandler : clerkMiddlewareHandler; ``` 3. If the Clerk middleware itself has a bug, investigate and fix rather than leaving all routes unprotected