[PR #40] [CLOSED] fix: include /api routes in default middleware matcher #261

New issue

Closed

opened 2026-05-06 12:38:50 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 12:38:50 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/40
Author: @SeolJaeHyeok
Created: 2/25/2026
Status: ❌ Closed

Base: main ← Head: fix/middleware-api-default-exclusion

📝 Commits (1)

878d7a0 fix: include /api routes in default middleware matcher

📊 Changes

2 files changed (+6 additions, -5 deletions)

View changed files

📝 packages/vinext/src/server/middleware.ts (+2 -2)
📝 tests/shims.test.ts (+4 -3)

📄 Description

Intro

Before reviewing this PR, I have a quick question. I've modified the default behavior of matchesMiddleware so that middleware is now applied to /api routes by default.
Was the previous behavior—excluding /api routes by default—an intentional design choice for this project?

If it was not intended, could you please review if my fix is the right approach?
Conversely, if it was intended, it seems the comment in packages/vinext/src/server/middleware.ts might be outdated or misleading regarding the current behavior. I would appreciate it if you could verify this as well.

Summary

The default matchesMiddleware behaviour (no matcher config) was incorrectly excluding /api-prefixed routes from middleware execution
Next.js runs middleware on all routes by default, including /api — only /_next internals, static files (paths with a file extension), and /favicon.ico are excluded
This silent skip meant any app relying on middleware for auth, logging, or header injection on API routes would have middleware not applied, unless the user explicitly added a matcher that re-included
/api

Changed files:

packages/vinext/src/server/middleware.ts — removed !pathname.startsWith("/api") from the no-matcher default, updated comment
tests/shims.test.ts — updated test assertions to reflect correct Next.js-compatible behaviour (/api/hello and /api/users/123 now expected to return true)

Test plan

pnpm test passes — all middleware matcher pattern tests updated and green
Existing middleware integration tests unaffected

References

Next.js proxy docs: "Proxy will be invoked for every route in your project"

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/40 **Author:** [@SeolJaeHyeok](https://github.com/SeolJaeHyeok) **Created:** 2/25/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/middleware-api-default-exclusion` --- ### 📝 Commits (1) - [`878d7a0`](https://github.com/cloudflare/vinext/commit/878d7a0866ef46193260160ede344c7ad2170271) fix: include /api routes in default middleware matcher ### 📊 Changes **2 files changed** (+6 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/server/middleware.ts` (+2 -2) 📝 `tests/shims.test.ts` (+4 -3) </details> ### 📄 Description ## Intro Before reviewing this PR, I have a quick question. I've modified the default behavior of `matchesMiddleware` so that middleware is now applied to `/api` routes by default. Was the previous behavior—excluding `/api` routes by default—an intentional design choice for this project? - If it **was not intended**, could you please review if my fix is the right approach? - Conversely, if it **was intended**, it seems the comment in [packages/vinext/src/server/middleware.ts](cci:7://file:///Users/seoljaehyeok/projects/open-source/vinext/packages/vinext/src/server/middleware.ts:0:0-0:0) might be outdated or misleading regarding the current behavior. I would appreciate it if you could verify this as well. ## Summary - The default `matchesMiddleware` behaviour (no `matcher` config) was incorrectly excluding `/api`-prefixed routes from middleware execution - Next.js runs middleware on **all** routes by default, including `/api` — only `/_next` internals, static files (paths with a file extension), and `/favicon.ico` are excluded - This silent skip meant any app relying on middleware for auth, logging, or header injection on API routes would have middleware not applied, unless the user explicitly added a matcher that re-included `/api` **Changed files:** - `packages/vinext/src/server/middleware.ts` — removed `!pathname.startsWith("/api")` from the no-matcher default, updated comment - `tests/shims.test.ts` — updated test assertions to reflect correct Next.js-compatible behaviour (`/api/hello` and `/api/users/123` now expected to return `true`) ## Test plan - [x] `pnpm test` passes — all middleware matcher pattern tests updated and green - [x] Existing middleware integration tests unaffected ## References - [Next.js proxy docs](https://nextjs.org/docs/app/api-reference/file-conventions/proxy#matching-paths#execution-order): *"Proxy will be invoked for every route in your project*" --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>