Proxy Use Cases

Auth gate

Read the session cookie. Redirect signed-out users away from protected paths and signed-in users away from /login.

Geolocation routing

Vercel exposes request.geo with country / region / city. Redirect to a locale-specific path on first hit.

A/B test bucketing

Set a cookie on first visit picking a variant. Subsequent requests read the cookie and route accordingly. The bucket survives navigation without server state.

Header rewriting

Add security headers, request IDs, or feature-flag headers that downstream code can read.

Use Proxy only when the decision depends on the incoming request before route selection, such as a locale cookie or experiment bucket. Make the rule deterministic, persist any bucket, and define what happens when the cookie or geolocation signal is absent. Authentication redirects, geo routing, and experiments look similar because all can redirect, but their authority differs. A proxy can improve navigation; it cannot prove ownership, turn an unreliable location hint into truth, or replace server-side experiment analysis.

Test first visit, repeat visit, missing cookie, malformed cookie, bot request, and an excluded static path. Verify that the chosen variant remains stable and that protected data rejects unauthorized access even when the proxy is bypassed.

Code

Auth gate·ts

import { NextRequest, NextResponse } from 'next/server';

export function proxy(request: NextRequest) {
  const session = request.cookies.get('session');
  const isAuth = request.nextUrl.pathname.startsWith('/login');
  const isProtected = request.nextUrl.pathname.startsWith('/app');

  if (isProtected && !session) {
    return NextResponse.redirect(new URL('/login', request.url));
  }
  if (isAuth && session) {
    return NextResponse.redirect(new URL('/app', request.url));
  }
  return NextResponse.next();
}

Geo redirect·ts

export function proxy(request: NextRequest) {
  const country = request.geo?.country ?? 'US';
  if (country === 'KR' && !request.nextUrl.pathname.startsWith('/ko')) {
    return NextResponse.redirect(new URL('/ko' + request.nextUrl.pathname, request.url));
  }
  return NextResponse.next();
}

A/B bucket·ts

export function proxy(request: NextRequest) {
  const bucket = request.cookies.get('ab')?.value;
  const res = NextResponse.next();
  if (!bucket) {
    res.cookies.set('ab', Math.random() < 0.5 ? 'A' : 'B', {
      maxAge: 60 * 60 * 24 * 30,
      httpOnly: true,
    });
  }
  return res;
}

Auth gate

Geolocation routing

A/B test bucketing

Header rewriting

Code

External links

Exercise

Progress

Comments 0