Middleware auth patterns in Astro

Guard dashboard and API routes with session checks on Cloudflare before rendering protected HTML or mutations.

Home desk with laptop, external monitor, and keyboard in a living space
Household members check the same dashboard from wherever they already work. Photo: David Wellbeloved / Flickr. CC BY 2.0

Authenticated dashboard pages must not rely on hidden UI alone. Astro middleware on Cloudflare can inspect cookies, validate JWT or session against Supabase, and redirect anonymous visitors to sign-in before expensive fetches run. The same layer protects API routes that mutate feed settings or trigger history inserts.

Request path through Astro middleware to auth check then dashboard render
Middleware intercepts protected routes, validates session, then allows SSR or redirects to sign-in.

What to protect

  • /dashboard/: settings, history, billing.
  • POST API routes: feed updates, contact submissions.
  • Leave public about and home unauthenticated unless A/B testing.

Session sources

Read HttpOnly cookies set during Supabase auth. Refresh tokens before SSR if your adapter supports it: details overlap cookie session lifecycle.

Edge considerations

Middleware runs at the edge, keep calls fast; cache public keys. Admin routes need role checks via group membership. Broader SSR context: Astro SSR.