Architecture scenarioHard~10 min

Interview question

What belongs in Next.js Proxy, and what does not?

Keeps Next.js 16 Proxy focused on request routing and optimistic checks rather than data access or final authorization.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

Next.js 16 renamed Middleware to Proxy to emphasize that it sits in front of routes. I use it for lightweight redirects, rewrites, request or response headers, locale routing, and optimistic cookie checks. I do not use it as the only authorization layer, for slow database access, or for full session and domain logic.

Full answer below

Practice focus

Proxy, middleware migration, matchers, redirects, headers, authentication, performance, and security boundaries.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Overview
Proxy runs before matched requests and can shape routing, but that position makes slow or security-critical business work especially risky.
Next.js 16 renamed Middleware to Proxy to emphasize that it sits in front of routes. I use it for lightweight redirects, rewrites, request or response headers, locale routing, and optimistic cookie checks. I do not use it as the only authorization layer, for slow database access, or for full session and domain logic.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
Matchers exclude static assets, image optimization, APIs that do not need the logic, and unnecessary prefetch requests. Simple permanent redirects or headers belong in configuration when that is sufficient. An authentication check in Proxy can improve the navigation experience, but the protected data layer, Server Action, or Route Handler repeats the secure decision. I also prevent open redirects and carefully control forwarded headers because Proxy executes on attacker-controlled requests.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
I measure the added latency across every matched route and keep dependencies compatible with the configured runtime. Proxy behavior is tested for direct URLs, prefetches, assets, malformed paths, alternate hosts, and bypass attempts. If logic needs authoritative database state, transactions, or large SDKs, it belongs deeper in the application. Observability records route pattern and decision without logging tokens, while loop detection protects rewrite and redirect rules from taking the site down.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Treating Proxy as a complete authorization boundary.
Running a database query on every asset and prefetch.
Using an unvalidated return URL in a redirect.

Red flagsCandidateRed flagsSignals that an interviewer may treat as risky.Open details

Details

A Proxy outage blocks every public static request.
The secure route assumes Proxy cannot be bypassed.
Redirect and rewrite rules can cycle.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

Why was Middleware renamed?
What should a matcher exclude?
Where does final authorization belong?

Continue practice

Move to the linked follow-up, next path step, prerequisite, or deeper variant.

1 linked

Next interviewer turn

Continue the conversation with a linked follow-up drill.

App Router auth boundariesDefines the narrow optimistic role Proxy can play in authentication.

Practice route

Read core answer Review checklist Follow-up prompts Track progress

Finished this drill?

Practice freely. Sign in only when you want to save completion, confidence, notes, or bookmarks.

New to Aporeon? Create account

Drill details

Human editorial direction

Aporeon is shaped by Aleksandar Tomovski, a software developer with experience on both sides of technical interviews. Content is reviewed for accuracy, natural spoken delivery, useful depth, and honest trade-offs.

About the creator Editorial standards

Was this drill useful?

Help improve the interview library.

Found this answer useful?

Say thanks with a standalone, one-time $5 contribution. No account required.

No subscription or perks.Choose another amount

Opening drill

Architecture scenarioHard~10 min

Interview question

What belongs in Next.js Proxy, and what does not?

Keeps Next.js 16 Proxy focused on request routing and optimistic checks rather than data access or final authorization.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

Full answer below

Practice focus

Proxy, middleware migration, matchers, redirects, headers, authentication, performance, and security boundaries.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Overview
Proxy runs before matched requests and can shape routing, but that position makes slow or security-critical business work especially risky.
Next.js 16 renamed Middleware to Proxy to emphasize that it sits in front of routes. I use it for lightweight redirects, rewrites, request or response headers, locale routing, and optimistic cookie checks. I do not use it as the only authorization layer, for slow database access, or for full session and domain logic.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
Matchers exclude static assets, image optimization, APIs that do not need the logic, and unnecessary prefetch requests. Simple permanent redirects or headers belong in configuration when that is sufficient. An authentication check in Proxy can improve the navigation experience, but the protected data layer, Server Action, or Route Handler repeats the secure decision. I also prevent open redirects and carefully control forwarded headers because Proxy executes on attacker-controlled requests.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
I measure the added latency across every matched route and keep dependencies compatible with the configured runtime. Proxy behavior is tested for direct URLs, prefetches, assets, malformed paths, alternate hosts, and bypass attempts. If logic needs authoritative database state, transactions, or large SDKs, it belongs deeper in the application. Observability records route pattern and decision without logging tokens, while loop detection protects rewrite and redirect rules from taking the site down.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Treating Proxy as a complete authorization boundary.
Running a database query on every asset and prefetch.
Using an unvalidated return URL in a redirect.

Red flagsCandidateRed flagsSignals that an interviewer may treat as risky.Open details

Details

A Proxy outage blocks every public static request.
The secure route assumes Proxy cannot be bypassed.
Redirect and rewrite rules can cycle.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

Why was Middleware renamed?
What should a matcher exclude?
Where does final authorization belong?

Continue practice

Move to the linked follow-up, next path step, prerequisite, or deeper variant.

1 linked

Next interviewer turn

Continue the conversation with a linked follow-up drill.

App Router auth boundariesDefines the narrow optimistic role Proxy can play in authentication.

What belongs in Next.js Proxy, and what does not?

Practice focus

Answer path

Overview

Review signals

Follow-up prompts

Continue practice

Next interviewer turn

What belongs in Next.js Proxy, and what does not?

Practice focus

Answer path

Overview

Review signals

Follow-up prompts

Continue practice

Next interviewer turn