fix(nextjs): stop protectRoute from redirecting to the protected route itself

[DonOmalVindula]

Problem

When neither protectRoute({redirect}) nor signInUrl is configured, the middleware redirected unauthenticated requests to the same-origin referer. Browsers keep the referer of the page that initiated a navigation across the whole redirect chain, so once the session expired while the user was on a protected page and they followed a link to another protected page, each redirect carried the same referer and the browser looped until ERR_TOO_MANY_REDIRECTS. The same happened when the configured sign-in target was itself covered by the protected matcher, or / was protected without a signInUrl. The JSDoc also listed a resolvedOptions.defaultRedirect fallback that does not exist.

Fix

• The referer is only used when it is a same-origin page other than the one being protected.
• When the resolved redirect target is the protected route itself, the middleware answers 401 (plain text with a hint to configure signInUrl / NEXT_PUBLIC_ASGARDEO_SIGN_IN_URL or exclude the sign-in page from the protected routes) instead of redirecting.
• JSDoc updated to the real fallback order.

Testing

• New middleware tests using real next/server requests: configured signInUrl, redirect option precedence, same-origin referer, cross-origin referer ignored, referer equal to the protected page, sign-in target equal to the protected route (401), protected root without a target (401). 67 tests pass.
• pnpm lint and tsc --noEmit for @asgardeo/nextjs.

Changeset included (@asgardeo/nextjs patch).

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

Next included review available in 57 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 1725d79a-394c-44bd-8d2c-016d4f5cc3d3

📥 Commits

Reviewing files that changed from the base of the PR and between 409ebae and 63ca88a.

📒 Files selected for processing (3)

• .changeset/nextjs-protect-route-redirect-loop.md
• packages/nextjs/src/server/middleware/__tests__/asgardeoMiddleware.test.ts
• packages/nextjs/src/server/middleware/asgardeoMiddleware.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[asgardeo-github-bot]

🦋 Changeset detected

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.