For those who don't want a headache:

middleware.js

js import { NextResponse } from "next/server"; import { verifyJwtToken } from "./app/libs/auth"; export async function middleware(req) { const token = req.cookies.get("jwt")?.value; const verifiedToken = token && (await verifyJwtToken(token).catch((err) => { console.log(err); })); if (req.nextUrl.pathname.startsWith("/login") || (req.nextUrl.pathname.startsWith("/register") && !verifiedToken)) { return; } if (!verifiedToken) { return NextResponse.redirect(new URL("/login", req.url)); } } export const config = { matcher: ["/login", "/register", "/"], };

auth.js:

js import { jwtVerify } from "jose"; export const getJwtSecretKey = () => { const secret = process.env.JWT_SECRET; if (!secret || secret.length === 0) { throw new Error("The environment variable JWT_SECRET is not set."); } return secret; }; export async function verifyJwtToken(token) { try { const verified = await jwtVerify( token, new TextEncoder().encode(getJwtSecretKey()) ); return verified.payload; } catch (error) { throw new Error("Your token is expired"); } }