Middleware, Headers, Cookies and the Request Lifecycle

Understand request interception, middleware use cases, cookies, headers, redirects, rewrites, and where security and routing logic belongs.

Understanding the Request Lifecycle

A request passes through several layers before the final UI or API response is returned. Depending on the application and deployment platform, this can involve edge infrastructure, middleware or proxy logic, routing, server rendering, data access, and caching.

Understanding this lifecycle helps explain why a redirect may happen before a page executes or why a response can be cached even though the page contains server code.

Simplified Request Lifecycle

Key Takeaways

A request can pass through multiple infrastructure layers.
Caching and routing decisions can happen before rendering.
Understanding the lifecycle makes debugging easier.

Middleware Use Cases

Middleware is useful for lightweight request-level logic such as redirects, rewrites, locale detection, and certain authentication-related routing decisions.

It should not become a general-purpose business-logic layer. Expensive database operations, complex business workflows, and large application services usually belong elsewhere.

Always consider the runtime and deployment constraints of middleware before importing libraries that depend on Node-specific APIs.

Key Takeaways

Use middleware for lightweight request interception.
Keep heavy business logic out of middleware.
Understand the runtime supported by your deployment environment.

Reading and Setting Cookies and Headers

Cookies and headers are fundamental parts of HTTP. Cookies commonly represent browser state, while headers communicate metadata such as authorization, content type, locale, and caching information.

Server code can read request information, while response logic can set cookies or headers when appropriate.

Cookie domain, path, Secure, HttpOnly, SameSite, and expiration settings must be considered carefully when building authentication across domains or subdomains.

Reading a Cookie

import { cookies } from 'next/headers';

export async function getCurrentSession() {
  const cookieStore = await cookies();
  const session = cookieStore.get('session');

  return session?.value;
}

💡 Server-side code can read request cookies through the framework cookie API.

Key Takeaways

Cookie behavior depends on domain, path, SameSite, Secure, and browser rules.
HttpOnly cookies cannot be read by normal browser JavaScript.
Cross-subdomain authentication requires deliberate cookie-domain design.

Redirects and Rewrites

A redirect tells the client or browser to use another URL. A rewrite maps one URL to another destination without necessarily changing the visible browser URL.

Redirects are useful when a resource has moved or authentication requires navigation to a login page. Rewrites can be useful for proxying or creating clean public URLs over internal paths.

Choose between them based on whether the browser should know that the URL changed.

Key Takeaways

Redirects change navigation.
Rewrites can preserve the visible URL while changing the destination.
URL behavior should be predictable and documented.

Understanding the Request Lifecycle

Middleware Use Cases

Reading and Setting Cookies and Headers

Redirects and Rewrites

STAY UPDATED WITH BYTES!