Next.js Middleware in 2026: Auth Guards, A/B Tests, and What Belongs at the Edge

Short summary

A practical guide to Next.js middleware in 2026 covering auth guards via JWT verification, A/B test cookie bucketing with rewrites, and what logic belongs at the edge versus in route handlers. On Vercel's Fluid Compute, middleware runs standard Node.js with a latency budget target under 10ms. Use matcher to scope middleware to relevant routes and avoid running it on static assets.

• •Middleware runs before cache and routing — ideal for auth redirects, A/B bucketing, and locale detection, wrong for DB queries
• •Auth in middleware means self-contained JWT verification without database calls; full session validation belongs in routes
• •Use matcher config to scope middleware; aim for under 10ms latency on Vercel Fluid Compute

Generated with AI, which can make mistakes.