Integration with Nextjs and @hono/auth-js

[jsellam]

Hello everyone,

In my Next.js project, I use Hono for the API part and @hono/auth-js for authentication.
Now, I want to block certain pages in the Next.js middleware when the user is not logged in. Unfortunately, at this point, I don't have access to the Hono context.

Could someone help me solve this issue?

Thanks in advance.

[EdamAme-x]

Maybe you can use this.

https://github.com/honojs/hono/tree/main/src%2Fmiddleware%2Fcontext-storage

[nferdica]

The Next.js middleware runs on the Edge and doesn't have access to Hono's context — they're separate execution layers. But you can still protect pages by reading the session cookie that @hono/auth-js sets.

Here are two approaches:

Option 1: Read the session cookie directly in Next.js middleware

@hono/auth-js uses Auth.js under the hood, which stores a session token in a cookie (usually authjs.session-token or __Secure-authjs.session-token). You can check for this cookie:

// middleware.ts
import { NextRequest, NextResponse } from 'next/server'

const protectedRoutes = ['/dashboard', '/settings', '/profile']

export function middleware(request: NextRequest) {
  const sessionToken =
    request.cookies.get('authjs.session-token')?.value ||
    request.cookies.get('__Secure-authjs.session-token')?.value

  const isProtected = protectedRoutes.some((route) =>
    request.nextUrl.pathname.startsWith(route)
  )

  if (isProtected && !sessionToken) {
    return NextResponse.redirect(new URL('/login', request.url))
  }

  return NextResponse.next()
}

export const config = {
  matcher: ['/dashboard/:path*', '/settings/:path*', '/profile/:path*'],
}

This is a lightweight check (cookie exists = probably logged in). It won't validate the JWT, but it handles the redirect fast on the Edge.

Option 2: Use contextStorage() middleware (as suggested above)

If you need the full session data, you can use Hono's contextStorage middleware to store the Hono context in AsyncLocalStorage, then access it from a shared utility. However, this only works on routes that go through Hono — the Next.js middleware for page routes won't have that context.

My recommendation: go with Option 1 for page protection (it's fast and Edge-compatible), and use @hono/auth-js verifyAuth() for API route protection within Hono.