Auth in middleware that skips API routes in Vercel
By ShipSecurely Editorial · Updated · How we make these guides
critical
Vercel deployment protection can put a login in front of a preview URL. That is not production auth.
Fix for Vercel
Vercel deployment protection can put a login in front of a preview URL. That is not production auth. A production deployment answers the public internet, and the handler still has to check the session. If you are self-hosting an older Next.js and the only check is middleware, read the CVE-2025-29927 advisory and upgrade. The advisory says deployments hosted on Vercel are already protected against that specific bypass.
The five-minute check, the other platforms, and the agent prompt are on the full guide. More Vercel fixes are on the Vercel page.