Issue with Session Revocation and Middleware in Next.js
I’m trying to revoke a user session in a Next.js app using middleware, but I’m running into a problem.
After calling revoke-sessions and redirecting the user (which triggers the middleware again), get-session still returns a session—even though it’s supposed to be revoked. This causes an infinite redirect loop (too many redirects).
Is it possible to properly delete or invalidate sessions from within the middleware? Or is there a better way to handle session revocation and redirection flow?
Or maybe I’m approaching this the wrong way, and the proper solution would be to handle this inside the customSession() plugin instead?
Any help would be appreciated 🙏
1 Reply
When I throw an error inside my customSession() function, it looks like the session is already created by that point.
Calling /api/auth/get-session then returns a 500 error instead of a clean 200 with an empty session.
