TikTok V5 + Security

src/middleware.ts

@@ -5,6 +5,7 @@ import {
   buildAttributionSnapshot,
   serializeAttributionCookie,
 } from '@/lib/revops';
+import { verifySignedUserIdEdge } from '@/lib/session-edge';
 
 const isProduction = process.env.NODE_ENV === 'production';
 
@@ -41,7 +42,7 @@ function attachAttributionCookie(req: NextRequest, response: NextResponse) {
   return response;
 }
 
-export function middleware(req: NextRequest) {
+export async function middleware(req: NextRequest) {
   const path = req.nextUrl.pathname;
   const hostname = req.headers.get('host')?.split(':')[0] || req.nextUrl.hostname;
 
@@ -157,8 +158,8 @@ export function middleware(req: NextRequest) {
     return attachAttributionCookie(req, NextResponse.next());
   }
 
-  // For protected routes, check for userId cookie
-  const userId = req.cookies.get('userId')?.value;
+  // For protected routes, require a validly signed userId cookie
+  const userId = await verifySignedUserIdEdge(req.cookies.get('userId')?.value);
 
   if (!userId) {
     // Not authenticated - redirect to signup