middleware.ts silently disables ALL auth when Clerk publishable key is a placeholder #13

New issue

Closed

opened 2026-08-12 03:47:40 +00:00 by Mark · 0 comments

Mark commented

2026-08-12 03:47:40 +00:00

Owner

src/middleware.ts: when NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY is unset or still the template placeholder, hasValidPublishableKey is false and the default export becomes () => NextResponse.next() — every protected route (including /api/trips, /api/items, /api/billing) is served unauthenticated. In production a missing/placeholder key should fail closed (500 or explicit auth-required), not open the API. Fix: always run clerkMiddleware; let Clerk fail requests when the key is invalid.

src/middleware.ts: when NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY is unset or still the template placeholder, hasValidPublishableKey is false and the default export becomes `() => NextResponse.next()` — every protected route (including /api/trips, /api/items, /api/billing) is served unauthenticated. In production a missing/placeholder key should fail closed (500 or explicit auth-required), not open the API. Fix: always run clerkMiddleware; let Clerk fail requests when the key is invalid.