Next.js 16: middleware.ts is now proxy.ts

Next 16 renamed the middleware.ts file convention to proxy.ts. Same signature, same NextRequest/NextResponse API — the export is now literally called what it does:

// proxy.ts (root of the app — was middleware.ts before Next 16)
export default function proxy(request: NextRequest) {
  const hasSession = request.cookies.has(ADMIN_COOKIE_NAME);
  if (!hasSession) {
    return NextResponse.redirect(new URL("/admin/login", request.url));
  }
  return NextResponse.next();
}

export const config = { matcher: ["/admin/:path*"] };

The rename is not cosmetic. "Middleware" invited people to put business logic in it; "proxy" says what this layer really is: a thin gate in front of the app. Two consequences I now treat as rules:

• Presence checks only. The proxy checks that a session cookie exists — it never unseals it. iron-session's unseal is async crypto; it belongs server-side, not in the hot edge path.
• Never the sole guard. Every protected page, layout and server action calls its own requireAdminSession(). The proxy turns away anonymous traffic fast; the real authentication happens again behind it. Defence in depth, not delegation.

All three Next apps in my monorepo migrated the same day — one of them uses the proxy purely for locale redirects, which fits the new name even better.