From 3ebf9823d5c995b8e2bc8240b3a11ec8cf7abbe7 Mon Sep 17 00:00:00 2001 From: Jared Pereira Date: Fri, 17 Apr 2026 20:11:29 -0400 Subject: [PATCH] skip auth redirect for crawlers on custom domains (#291) The middleware redirects unauthenticated custom-domain visitors through leaflet.pub/auth_callback to hydrate an external_auth_token cookie. Bots don't hold cookies or run JS, so they never complete the handshake and end up indexing the redirect instead of the publication. Detect common crawler/social preview user agents and let them through unauthenticated. Co-authored-by: Claude --- middleware.ts | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/middleware.ts b/middleware.ts index 27b6e977..0d0294d6 100644 --- a/middleware.ts +++ b/middleware.ts @@ -38,6 +38,15 @@ type DomainRoutes = Awaited>; const auth_callback_route = "/auth_callback"; const receive_auth_callback_route = "/receive_auth_callback"; + +const botUserAgentRegex = + /bot|crawler|spider|crawling|facebookexternalhit|facebookcatalog|whatsapp|telegram|slackbot|discordbot|linkedinbot|twitterbot|embedly|quora link preview|pinterest|redditbot|applebot|duckduckbot|baiduspider|yandex|bingpreview|vkshare|w3c_validator|mastodon|pleroma|misskey|iframely|skypeuripreview|google-inspectiontool|chrome-lighthouse/i; + +function isBot(req: NextRequest) { + let ua = req.headers.get("user-agent"); + if (!ua) return false; + return botUserAgentRegex.test(ua); +} export default async function middleware(req: NextRequest) { let hostname = req.headers.get("host")!; if (req.nextUrl.pathname === auth_callback_route) return authCallback(req); @@ -76,6 +85,7 @@ export default async function middleware(req: NextRequest) { if ( !isStaticReq && + !isBot(req) && (!cookie || req.nextUrl.searchParams.has("refreshAuth")) && !authCompleted && !hostname.includes("leaflet.pub") -- 2.51.2