NextJS Middleware Auth Examples recommends using function that doesn't exist

[ethanniser]

Improve documentation

Link

https://supabase.com/docs/guides/auth/server-side/nextjs?queryGroups=router&router=app

Describe the problem

The main issue is that the current example is structured in a way were it assumes the only thing you will ever do in your middleware is authenticate with supabase, but often I would think that is not the case.

My current project has some complex redirection logic, so I can't just simply return the supabaseResponse. The docs suggest making a new NextResponse and manually setting the cookies

const myNewResponse = NextResponse.next({ request })
myNewResponse.cookies.setAll(supabaseResponse.cookies.getAll())

The only problem is the cookies property on NextResponse is of type ResponseCookies which does not actually have a setAll method.

Describe the improvement

It would be fantastic if there was:

• A recommended way to pass on the Supabase cookies to new responses
• An example where the middleware does more than simply return await updateSession
• Maybe an example repo to go off of and could be linted as to avoid recommending non existent or depreciated apis

---

I'm upgrading my auth from 0.6 @supabase/auth-helpers-nextjs and I was actually in the process of writing a separate issue earlier asking for the docs to no longer recommend get, set and delete, but #27242 literally merged as I was writing it (thanks @hf), but I've run into this separate issue now. If any other additional information is needed just let me know- happy to help.

Thanks so much

[ErikPetersenDev]

Just to link things together I thought I'd share that there's also a Discussion I just came across that covers a couple other documentation issues on the same page (https://supabase.com/docs/guides/auth/server-side/nextjs?queryGroups=router&router=app).

Discussion: https://github.com/orgs/supabase/discussions/27619

To summarize quickly:

• data: user should be data: { user} (otherwise if block is never executed)
• The if statement needs to skip the login route or it'll create a redirect loop (e.g., if (!user && !request.nextUrl.pathname.startsWith("/login")))
• NextResponse.redirect('/login') doesn't work in middleware (reference: https://nextjs.org/docs/messages/middleware-relative-urls)... I believe it should be:

const url = request.nextUrl.clone();
url.pathname = "/login";
return NextResponse.redirect(url);

EDIT: I've opened a PR for the issues from the Discussion, but it doesn't address this Issue. #27622.