Middleware is ok for authentication (checking who a user is), but not for authorization (checking if a user is allowed to do something) which is what you're looking at here

You should check this manually in every server function before you perform the action.

Thanks for response. But like I said in that post I do check in server function but problem is that server function is never invoked due to "redirect" in middleware. Instead server function just returns undefined (see this one too).

@jacobparis

You can bypass middleware for your functions based on the next-action header

1export const config = {2  matcher: [3    /*4     * Match all request paths except for the ones starting with:5     * - api (API routes)6     * - _next/static (static files)7     * - _next/image (image optimization files)8     * - favicon.ico (favicon file)9     */10    {11      source:12        '/((?!api|_next/static|_next/image|media|fonts|favicon.ico|favicon.png).*)',13      missing: [14        // Exclude Server Actions15        { type: 'header', key: 'next-action' },16      ],17    },18  ],19};

That makes more sense! That solution was from gh issue I linked but initially i thought it was based on checking "api" in routes - and thought it would not work. It seems it checks header.

I will verify if it works tomorrow.

It would be nice to add this info in Nextjs docs don't you think? Especially like I said lots of guides (even from vercel team) use middleware for authentication/authorization afaik.