Next.js Middleware

Relevant source files

The following files were used as context for generating this wiki page:

• cooltools/middleware.ts
• cooltools/next.config.ts
• cooltools/package.json
• cooltools/app/layout.tsx
• SECURITY.md

Next.js Middleware in the CoolTools project serves as a centralized request processing layer that executes before a request is completed. Its primary responsibility in this architecture is the enforcement of security policies by injecting specific HTTP headers into the response stream for all non-static and non-internal routes.

This layer ensures that every page served to the user—including the main Layout and specialized routes like Phones or Compare—adheres to modern web security standards. It operates at the edge, intercepting NextRequest objects and returning modified NextResponse objects.

Sources: cooltools/middleware.ts:1-14, cooltools/app/layout.tsx:1-25

Middleware Architecture and Flow

The middleware is implemented as a single exported function that utilizes the NextResponse.next() method. This approach allows the request to continue its lifecycle while allowing the middleware to decorate the response with security-related metadata.

Request Interception Flow

The following diagram illustrates how the middleware intercepts an incoming user request, applies security headers, and then passes the request to the application pages.

The middleware acts as a gatekeeper for the application's page routes, ensuring consistent header application across the entire platform.
Sources: cooltools/middleware.ts:4-16, cooltools/app/layout.tsx:27-35

Implementation Logic

The middleware function takes a NextRequest and generates a NextResponse which is then mutated to include specific security directives.

export function middleware(request: NextRequest) {
  const response = NextResponse.next();
  
  // Security headers
  response.headers.set('X-Content-Type-Options', 'nosniff');
  response.headers.set('X-Frame-Options', 'DENY');
  response.headers.set('X-XSS-Protection', '1; mode=block');
  response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
  
  return response;
}

Sources: cooltools/middleware.ts:4-14

Security Header Configuration

The middleware implements four critical security headers designed to protect users and the application from common web vulnerabilities.

Header	Value	Purpose
X-Content-Type-Options	nosniff	Prevents the browser from MIME-sniffing a response away from the declared content-type.
X-Frame-Options	DENY	Protects against Clickjacking by preventing the site from being rendered in an iframe.
X-XSS-Protection	1; mode=block	Enables the browser's Cross-Site Scripting (XSS) filter and blocks the page if an attack is detected.
Referrer-Policy	strict-origin-when-cross-origin	Controls how much referrer information is included with requests.

These configurations align with the project's overall security policy for supported versions.
Sources: cooltools/middleware.ts:8-11, SECURITY.md:5-12

Execution Scope and Matcher

To optimize performance and avoid unnecessary processing, the middleware uses a config object with a matcher regex. This prevents the middleware from running on API routes, static assets, and internal Next.js files.

Matcher Specification

The matcher is defined to exclude specific patterns:

• api: Backend API endpoints.
• _next/static: Compiled static files (CSS, JS).
• _next/image: Optimized images.
• favicon.ico: The site's favicon.

export const config = {
  matcher: '/((?!api|_next/static|_next/image|favicon.ico).*)',
};

Sources: cooltools/middleware.ts:16-18, cooltools/next.config.ts:3-5

Dependencies and Runtime

The middleware relies on the Next.js server runtime and specific types provided by the next package.

The middleware is part of a Next.js 15.5.4 environment, utilizing TypeScript for type safety during request and response handling.
Sources: cooltools/package.json:19, cooltools/middleware.ts:1-14

Conclusion

The Middleware in CoolTools provides a non-intrusive yet robust security layer. By intercepting requests and standardizing HTTP headers, it ensures that all user-facing components—from the home page to complex comparison tools—operate within a secure environment without requiring per-page header logic.