authMiddleware: How to protect just a single route?

[stx-chris]

Similar to the discussion in #2076, we would like to protect only the /dashboard route including its sub-routes in our Next.js 14 app middleware. Most of our content is public, but it is very tedious to include each and every bit in the publicRoutes config.

We also have a lot of pages at root level, such as /pricing, /contact etc., which we also would like not to list each time a new page is created.

What would be the best way to achieve protection of /dashboard and /dashboard/* only? Thanks!

[officialrajdeepsingh]

// middleware.ts

import { authMiddleware } from "@clerk/nextjs";

// This example protects all routes including api/trpc routes
// Please edit this to allow other routes to be public as needed.
// See https://clerk.com/docs/references/nextjs/auth-middleware for more information about configuring your Middleware

export default authMiddleware({});

export const config = {
  matcher: ['/dashboard(.*)'],
};

Learn more about matcher: https://nextjs.org/docs/app/building-your-application/routing/middleware#matcher

[stx-chris]

Thanks @officialrajdeepsingh, but this excludes all other routes from general middleware processing. It appears that the "protect everything" default policy of Clerk doesn't play well with real-life use cases with Next.js.

In our projects, middleware.ts does a lot of filtering, validating and redirecting. Clerk should only be incorporated for sites that require protection. It seems just more logical to have a property protectedRoutes rather than publicRoutes.

Our current workaround is to return false from beforeAuth in case the route doesn't need protection and returning NextResponse.next() for routes which do indeed need protection.

[stx-chris]

For anybody having the same issue, it is not clear in the Clerk documentation that publicRoutes and ignoredRoutes receive the req as parameter. This can be used to construct the necessary filter:

  publicRoutes: (req: NextRequest) =>
    !req.nextUrl.pathname.startsWith("/dashboard"),