update nextjs middleware

Author: pilcrowonpaper

pages/sessions/cookies/nextjs.md

@@ -83,29 +83,33 @@ export function deleteSessionTokenCookie(): void {
 }
 ```
 
-Since we can't extend set cookies insides server components due to a limitation with React, we recommend continuously extending the cookie expiration inside middleware.
+Since we can't extend set cookies insides server components due to a limitation with React, we recommend continuously extending the cookie expiration inside middleware. However, this comes with its own issue. Next.js revalidates data when a server action response sets a cookie directly with `cookies()` or indirectly with `NextResponse.cookies` via middleware. We also can't detect if a new cookie was set inside server actions or route handlers from middleware. As such, we'll only extend the cookie expiration on GET requests.
 
 ```ts
 // middleware.ts
 import { NextResponse } from "next/server";
-import { cookies } from "next/headers";
 
 import type { NextRequest } from "next/server";
 
 export async function middleware(request: NextRequest): Promise<NextResponse> {
-	const token = cookies().get("session")?.value ?? null;
-	if (token !== null) {
-		// Not using `setSessionCookie()` to avoid accidentally importing Node-only modules.
-		cookies().set("session", token, {
-			httpOnly: true,
-			sameSite: "lax",
-			secure: process.env.NODE_ENV === "production",
-			maxAge: 60 * 60 * 24 * 30, // 30 days
-			path: "/"
-		});
+	if (request.method === "GET") {
+		const response = NextResponse.next();
+		const token = request.cookies.get("session")?.value ?? null;
+		if (token !== null) {
+			// Only extend cookie expiration on GET requests since we can be sure
+			// a new session wasn't set when handling the request.
+			response.cookies.set("session", token, {
+				path: "/",
+				maxAge: 60 * 60 * 24 * 30,
+				sameSite: "lax",
+				httpOnly: true,
+				secure: process.env.NODE_ENV === "production"
+			});
+		}
+		return response;
 	}
 
-	// CSRF protection, etc
+	// CSRF protection
 
 	return NextResponse.next();
 }