So the session cookie definitely exists.

❌ The Problem

When navigating to:

1
/dashboard/organization
2

I get:

1
307 redirect → /login
2

In Network tab I see:

• Next-Router-Prefetch: 1

• Rsc: 1

• No Cookie header present in request

So middleware sees no cookie and redirects.

🧠 My Middleware

1
export function proxy(request: NextRequest) {
2
  const sessionCookie =
3
    request.cookies.get("better-auth.session_token") ??
4
    request.cookies.get("_Secure-better-auth.session_token") ??
5
    request.cookies.get("__Secure-better-auth.session_token") ??
6
    request.cookies.getAll().find((c) =>
7
      c.name.endsWith("better-auth.session_token")
8
    );
9

10
  if (!sessionCookie?.value) {
11
    return NextResponse.redirect(new URL("/login", request.url));
12
  }
13

14
  return NextResponse.next();
15
}
16

17
export const config = {
18
  matcher: ["/dashboard/:path*"],
19
};
20

I also tried skipping prefetch requests:

1
if (request.headers.get("next-router-prefetch") === "1") {
2
  return NextResponse.next();
3
}
4

Still not working.

⚠️ Important Observation

In production:

• The prefetch request to /dashboard/... does not include cookies.

• Middleware runs.

• It redirects to /login.

• Navigation ends up redirecting even though user is logged in.

In local dev this never happens.

🧩 Questions

1. Is this expected behavior for RSC prefetch requests in production?

2. Should middleware skip auth checks for RSC/prefetch?

3. Is this a known limitation of middleware + App Router?

4. Is there a better pattern for auth protection in App Router?

🎯 Expected Behavior

If user is authenticated (valid session cookie exists), navigating to /dashboard should not redirect.

If anyone has run into this with:

• Next.js 14+

• Vercel

• Better Auth / Auth.js / custom auth

• App Router middleware

I’d really appreciate guidance 🙏

If you want, I can also give you:

• A shorter Discord-style version

• A StackOverflow-formatted version

• Or a more technical deep-dive version for the Next.js repo

Just tell me where you're planning to post it.