End-to-end auth flow: GitHub OAuth callback, session management, middleware protection, and logout handling in Next.js + Supabase.
BeforeMerge offers hundreds of code review rules, guides, and detection patterns to help your team ship better code.
User clicks "Sign in with GitHub"
→ Supabase OAuth redirect
→ GitHub authorization
→ Callback to /auth/callback
→ Session cookie set
→ Middleware validates on every request
→ Protected pages render with user context// middleware.ts
export async function middleware(request: NextRequest) {
let supabaseResponse = NextResponse.next({ request })
const supabase = createServerClient(url, key, { cookies: ... })
// MUST call getUser() immediately after createServerClient
const { data: { user } } = await supabase.auth.getUser()
if (!user && isProtectedRoute(request.nextUrl.pathname)) {
return NextResponse.redirect(new URL("/login", request.url))
}
// MUST return supabaseResponse unchanged
return supabaseResponse
}