Middleware authentication bypass on prerendered routes in Astro 4.x
Protection gap between SSR and static routes Astro 4.x defaults to static-first rendering, where routes under src/pages/ are prerendered unless explicitly opted into SSR with export const prerender = false . Middleware defined in src/middleware/ executes on every request in SSR mode but is completely skipped for prerendered routes, which serve prebuilt HTML
astro