next.js: [NEXT-1088] After upgrading to 13.3 from 13.2 middleware is not working anymore

Verify canary release

• I verified that the issue exists in the latest Next.js canary release

EDIT: Downgraded to 13.2.4 and it is working again, what could be the issue?

This is my middleware and when I click in my client login component the login button, in the network tab login is pending and doesn’t do anything, when i rename middleware.js to middleware.bak and I retry it works, and it was working fine before I updated to 13.3

I hope its a bug or something changed

I’m using the app folder

This is my code:

Provide environment information

import { NextResponse } from 'next/server';

export const config = {
  // matcher solution for public, api, assets and _next exclusion
  matcher: '/((?!api|static|.*\\..*|_next).*)',
};

const maintenance = 'false';

function setAccessTokenCookie(response, accessToken) {
  response.cookies.set('access', accessToken, {
    httpOnly: true,
    maxAge: 10 * 60 * 10, // 10 minutes
  });

  return response;
}

async function refreshAccessToken(request, origin) {
  const refreshCookie = request.cookies.get('refresh')?.value;
  if (!refreshCookie) return null;

  const res = await fetch(process.env.BASE_URL + `/auth/refresh`, {
    headers: { refresh: refreshCookie },
  });

  if (!res.ok) return null;

  const { accessToken } = await res.json();

  return accessToken;
}

async function verifyAccessToken(request, origin) {
  const accessCookie = request.cookies.get('access')?.value;
  const refreshCookie = request.cookies.get('refresh')?.value;

  if (!accessCookie && !refreshCookie) return null;

  const res = await fetch(process.env.BASE_URL + `/auth/verify`, {
    headers: { access: accessCookie, refresh: refreshCookie },
  });

  if (!res.ok) return null;

  const { success } = await res.json();

  return success ?? null;
}

function clearAuthCookies(response) {
  response.cookies.set('auth', 'false');
  response.cookies.set('access', '', {
    httpOnly: true,
    expires: new Date(0),
  });
  response.cookies.set('refresh', '', {
    httpOnly: true,
    expires: new Date(0),
  });
  return response;
}

export async function middleware(request) {
  const { method, pathname, origin } = request.nextUrl;

  if (maintenance === 'true' && pathname !== '/maintenance') {
    return NextResponse.redirect(process.env.SITE_URL + `/maintenance`);
  } else if (maintenance === 'false' && pathname == '/maintenance') {
    return NextResponse.redirect(process.env.SITE_URL + `/`);
  }

  const response = NextResponse.next();
  const refreshCookie = request.cookies.get('refresh')?.value;
  const accessCookie = request.cookies.get('access')?.value;

  let user = await verifyAccessToken(request, origin);

  if (user && refreshCookie) {
    if (pathname.startsWith('/auth/')) {
      response.cookies.set('auth', 'true');
      return NextResponse.redirect(process.env.SITE_URL + `/app/dashboard`);
    }
    response.cookies.set('auth', 'true');
    return NextResponse.next(response);
  } else if (user && !refreshCookie) {
    clearAuthCookies(response);
    if (pathname.startsWith('/app/')) {
      return NextResponse.redirect(process.env.SITE_URL + `/auth/login`);
    }
    return NextResponse.next(response);
  } else if (!user && refreshCookie) {
    let newAccess = await refreshAccessToken(request, origin);

    if (newAccess) {
      try {
        setAccessTokenCookie(response, newAccess);
      } catch (error) {
        clearAuthCookies(response);
        if (pathname.startsWith('/app/')) {
          return NextResponse.redirect(process.env.SITE_URL + `/auth/login`);
        }
        return NextResponse.next(response);
      }
      if (pathname === '/auth/login') {
        response.cookies.set('auth', 'true');
        return NextResponse.redirect(process.env.SITE_URL + `/app/dashboard`);
      }
      return response;
    } else if (!newAccess) {
      clearAuthCookies(response);
      if (pathname.startsWith('/app/')) {
        return NextResponse.redirect(process.env.SITE_URL + `/auth/login`);
      }
      return NextResponse.next(response);
    }
  } else if (!user && !refreshCookie) {
    clearAuthCookies(response);
    if (pathname.startsWith('/app/')) {
      return NextResponse.redirect(process.env.SITE_URL + `/auth/login`);
    }
    response.cookies.set('auth', 'false');
    return NextResponse.next(response);
  }
}

Which area(s) of Next.js are affected? (leave empty if unsure)

App directory (appDir: true), Middleware / Edge (API routes, runtime)

Link to the code that reproduces this issue

N/A

To Reproduce

Upgraded from 13.2 to 13.3

Describe the Bug

My middleware is not working which was working completely fine before update

Expected Behavior

I should be sent to the dashboard page after clicking the login button

Which browser are you using? (if relevant)

No response

How are you deploying your application? (if relevant)

No response

_NEXT-1088