Next.js 15 미들웨어 완벽 가이드 — 인증·리다이렉트·리라이트 실전 패턴

my-app/
├─ app/
│  ├─ layout.tsx
│  └─ page.tsx
├─ middleware.ts   ← 여기!
├─ next.config.ts
└─ package.json

// middleware.ts
import { NextResponse } from "next/server"
import type { NextRequest } from "next/server"

export function middleware(request: NextRequest) {
  // 여기서 요청을 가로채서 원하는 작업 수행
  return NextResponse.next()
}

// 어떤 경로에서 미들웨어를 실행할지 지정
export const config = {
  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
}

// middleware.ts
import { NextResponse } from "next/server"
import type { NextRequest } from "next/server"

const PROTECTED = ["/dashboard", "/settings", "/billing"]

export function middleware(req: NextRequest) {
  const { pathname } = req.nextUrl
  const needsAuth = PROTECTED.some(p => pathname.startsWith(p))
  if (!needsAuth) return NextResponse.next()

  const token = req.cookies.get("session")?.value
  if (!token) {
    const loginUrl = new URL("/login", req.url)
    loginUrl.searchParams.set("from", pathname) // 로그인 후 원래 경로로 복귀
    return NextResponse.redirect(loginUrl)
  }

  // 필요하면 JWT 검증 (Edge 호환 라이브러리: jose 추천)
  return NextResponse.next()
}

export const config = {
  matcher: ["/dashboard/:path*", "/settings/:path*", "/billing/:path*"],
}

// middleware.ts
import { NextResponse } from "next/server"
import type { NextRequest } from "next/server"

const LOCALES = ["ko", "en", "ja"] as const
const DEFAULT_LOCALE = "en"

function pickLocale(req: NextRequest) {
  const country = req.geo?.country?.toLowerCase()
  if (country === "kr") return "ko"
  if (country === "jp") return "ja"

  const accept = req.headers.get("accept-language") ?? ""
  const preferred = accept.split(",")[0]?.split("-")[0]
  return LOCALES.includes(preferred as any) ? preferred : DEFAULT_LOCALE
}

export function middleware(req: NextRequest) {
  const { pathname } = req.nextUrl
  const hasLocale = LOCALES.some(
    l => pathname === `/${l}` || pathname.startsWith(`/${l}/`)
  )
  if (hasLocale) return NextResponse.next()

  const locale = pickLocale(req)
  return NextResponse.redirect(new URL(`/${locale}${pathname}`, req.url))
}

export const config = {
  matcher: ["/((?!_next|api|.*\\..*).*)"],
}

// middleware.ts
import { NextResponse } from "next/server"
import type { NextRequest } from "next/server"

export function middleware(req: NextRequest) {
  if (req.nextUrl.pathname !== "/pricing") return NextResponse.next()

  let bucket = req.cookies.get("ab-pricing")?.value
  if (bucket !== "a" && bucket !== "b") {
    bucket = Math.random() < 0.5 ? "a" : "b"
  }

  const url = req.nextUrl.clone()
  url.pathname = bucket === "b" ? "/pricing-b" : "/pricing-a"

  const res = NextResponse.rewrite(url)
  res.cookies.set("ab-pricing", bucket, {
    httpOnly: true,
    sameSite: "lax",
    maxAge: 60 * 60 * 24 * 30,
  })
  return res
}

export const config = {
  matcher: ["/pricing"],
}

// middleware.ts
import { NextResponse } from "next/server"
import type { NextRequest } from "next/server"
import { Ratelimit } from "@upstash/ratelimit"
import { Redis } from "@upstash/redis"

const ratelimit = new Ratelimit({
  redis: Redis.fromEnv(),
  limiter: Ratelimit.slidingWindow(30, "10 s"), // 10초당 30회
})

const BAD_UA = /(curl|wget|python-requests|scrapy)/i

export async function middleware(req: NextRequest) {
  const ua = req.headers.get("user-agent") ?? ""
  if (BAD_UA.test(ua)) {
    return new NextResponse("Forbidden", { status: 403 })
  }

  const ip = req.ip ?? req.headers.get("x-forwarded-for") ?? "anon"
  const { success, remaining } = await ratelimit.limit(ip)

  if (!success) {
    return new NextResponse("Too Many Requests", { status: 429 })
  }

  const res = NextResponse.next()
  res.headers.set("X-RateLimit-Remaining", String(remaining))
  return res
}

export const config = {
  matcher: ["/api/:path*"],
}

// middleware.ts
import { NextResponse } from "next/server"
import type { NextRequest } from "next/server"

// 예: /posts/123 → /blog/123 로 영구 리다이렉트
export function middleware(req: NextRequest) {
  const { pathname } = req.nextUrl
  const match = pathname.match(/^\/posts\/(\d+)$/)
  if (!match) return NextResponse.next()

  const url = req.nextUrl.clone()
  url.pathname = `/blog/${match[1]}`
  return NextResponse.redirect(url, 308) // 301 대신 308(Permanent) 권장
}

export const config = {
  matcher: ["/posts/:id*"],
}

export const config = {
  matcher: [
    // 1) 특정 경로만
    "/dashboard/:path*",

    // 2) 정적 파일/내부 경로 제외 (가장 흔함)
    "/((?!api|_next/static|_next/image|favicon.ico|robots.txt|sitemap.xml).*)",

    // 3) 헤더 조건까지 조합 (Next 13.5+ 확장 문법)
    {
      source: "/((?!api/).*)",
      has: [{ type: "header", key: "x-admin-preview", value: "true" }],
    },
  ],
}