Learning Tutrial Chapter 14, "authorized" in the callbacks configuration of NextAuth's auth.config.ts was not triggered.

[gaomigithub]

Summary

Hello guys,

I am currently learning about Next course from offical site and doing Chapter#14 (Adding Authentication). Other features such as "login" and "signout" learned from C#14 work good.

When I am testing what I did by learning at Protecting your routes with Next.js Proxy

export const authConfig = {
  pages: {
    signIn: '/login',
  },
  callbacks: {
    authorized({ auth, request: { nextUrl } }) {
      const isLoggedIn = !!auth?.user;
      const isOnDashboard = nextUrl.pathname.startsWith('/dashboard');
      console.log('Is logged in:', isLoggedIn, 'Is on dashboard:', isOnDashboard)
      if (isOnDashboard) {
        if (isLoggedIn) return true;
        return false; // Redirect unauthenticated users to login page
      } else if (isLoggedIn) {
        return Response.redirect(new URL('/dashboard', nextUrl));
      }
      return true;
    },
  },
  providers: [], // Add providers with an empty array for now
} satisfies NextAuthConfig;

This feels like nothing happened. I still can direct to any URL and not being redirected to login page.

Tried some search on Google and AI but they all tell me I did correct and should be work.... Also, I can not find the log I left inside authorized. I am really confused right now.

My repo

I pushed my codes wrote in this Chapter with commit name: "Chapter 14: Adding Authentication; todo: something wrong with authConfig".

Please give me any hint you find.
Thank you soooo much!!!

Additional information

// auth.config.ts

import type { NextAuthConfig } from 'next-auth';
 
export const authConfig = {
  pages: {
    signIn: '/login',
  },
  callbacks: {
    authorized({ auth, request: { nextUrl } }) {
      const isLoggedIn = !!auth?.user;
      const isOnDashboard = nextUrl.pathname.startsWith('/dashboard');
      console.log('Is logged in:', isLoggedIn, 'Is on dashboard:', isOnDashboard)
      if (isOnDashboard) {
        if (isLoggedIn) return true;
        return false; // Redirect unauthenticated users to login page
      } else if (isLoggedIn) {
        return Response.redirect(new URL('/dashboard', nextUrl));
      }
      return true;
    },
  },
  providers: [], // Add providers with an empty array for now
} satisfies NextAuthConfig;

// proxy.ts

import NextAuth from 'next-auth';
import { authConfig } from './auth.config';
 
export default NextAuth(authConfig).auth;
 
export const config = {
  // https://nextjs.org/docs/app/api-reference/file-conventions/proxy#matcher
  matcher: ['/((?!api|_next/static|_next/image|.*\\.png$).*)'],
};

// package.json

{
  "private": true,
  "scripts": {
    "build": "next build",
    "dev": "next dev --turbopack",
    "start": "next start",
    "lint": "pnpm next lint"
  },
  "dependencies": {
    "@heroicons/react": "^2.2.0",
    "@tailwindcss/forms": "^0.5.10",
    "autoprefixer": "10.4.20",
    "bcrypt": "^5.1.1",
    "clsx": "^2.1.1",
    "next": "15.2.3",
    "next-auth": "5.0.0-beta.30",
    "postcss": "8.5.1",
    "postgres": "^3.4.6",
    "react": "latest",
    "react-dom": "latest",
    "tailwindcss": "3.4.17",
    "use-debounce": "^10.0.4",
    "zod": "^3.25.17"
  },
  "devDependencies": {
    "@next/eslint-plugin-next": "^16.0.1",
    "@types/bcrypt": "^5.0.2",
    "@types/node": "22.10.7",
    "@types/react": "19.0.7",
    "@types/react-dom": "19.0.3",
    "@typescript-eslint/eslint-plugin": "^8.46.3",
    "@typescript-eslint/parser": "^8.46.3",
    "eslint": "^9.39.1",
    "eslint-config-next": "^15.2.3",
    "typescript": "5.7.3"
  },
  "pnpm": {
    "onlyBuiltDependencies": [
      "bcrypt",
      "sharp"
    ]
  }
}

Example

https://github.com/gaomigithub/nextjs-dashboard

[Denoroy737]

Hey @gaomigithub 👋

I ran into this same issue while following the Next.js Dashboard tutorial. The problem isn’t with your logic — it’s actually with how Next.js detects middleware.

The authorized callback in your auth.config.ts only runs when the file using NextAuth(authConfig).auth is treated as a middleware by Next.js. Right now, you’ve named it proxy.ts, and that’s the catch — Next.js doesn’t automatically treat that file as middleware.

---

How to fix it

Just rename your file from:

proxy.ts → middleware.ts

Keep everything else exactly the same:

import NextAuth from "next-auth";
import { authConfig } from "./auth.config";

export default NextAuth(authConfig).auth;

export const config = {
  matcher: ["/((?!api|_next/static|_next/image|.*\\.png$).*)"],
};

Once you do that, Next.js will correctly recognize it as a middleware file, and your authorized callback will start triggering as expected. You should see your console.log output appear in the terminal (not in the browser console — since middleware runs server-side).

---

Tip

If you’d rather keep the file named proxy.ts, then just add a small middleware.ts file that re-exports it:

export { default } from './proxy'
export { config } from './proxy'

That works too.

---

So yeah, nothing’s wrong with your auth logic — it’s just a naming thing. Once the middleware is properly detected, your redirects will start working perfectly.

[lewiii254]

The reason your authorized callback never ran is exactly because proxy.ts is not treated as middleware by Next.js. Middleware must be named middleware.ts (or live inside /middleware/) for Next.js to register it.

Once you rename proxy.ts → middleware.ts, the whole chain becomes active:

• Next.js picks up the middleware
• NextAuth registers its auth() handler
• the authorized callback finally runs
• your logs show up in the terminal
• redirects work as expected

Dynamic routes and your config are all correct — it was purely a filename detection issue. After renaming, everything should behave exactly like in the tutorial.