Files
Steve Faulkner 95905ec7ba fix: serve public directory files after middleware in production (#602)
* fix: serve public directory files after middleware in production

Static file serving in the production server ran before middleware for
all files, including those from the public directory. This meant
middleware could not intercept or redirect requests to public files
like /admin/report.pdf or /internal/data.json.

Split static serving into two phases in both Pages Router and App
Router production servers:
- Before middleware: serve only hashed build assets from /assets/
  (Vite output, always public, no protection needed)
- After middleware: serve all other static files (public directory
  content) so middleware can run first

For Pages Router, middleware response headers (Set-Cookie, security
headers, etc.) are passed through to static file responses via the
extraHeaders parameter.

For App Router, public directory files fall through to the RSC
handler, which runs middleware internally before serving them.

* apply config headers before serving public directory static files

Step 6 (next.config.js headers) now runs before step 5b (public directory
static files), so headers configured via next.config.js headers rules are
included in responses for public directory files, matching Next.js behavior.

---------

Co-authored-by: James <james@eli.cx>
2026-03-20 10:21:25 +00:00
..
2026-02-24 09:29:39 -06:00

vinext

This file is overwritten from the repo root README.md during prepack. Edit the root README.md instead.