redirect action to protected routes(protect with middleware) without authorization will result in URL change

[ehsanrezaeee]

Link to the code that reproduces this issue

https://github.com/ehsanrezaeee/next-redirect-bug

To Reproduce

1.Start the application in development mode
2.Click on the deleteCookies button to make sure you are not authenticated.
3.Click on the redirect to protected route using server action Button
4.URL changes but the page doesn't because of the middleware.

Current vs. Expected behavior

Current Behavior:

• if you are authenticated using setCookies button (set cookie server action) you can redirect to protectedroute page with either Link or "redirect to protected route using server action" button. However, if you are not authenticated, the Link component will work exaclty as it is but the "redirect to protected route using server action" wont work properly

• the "redirect to protected route using server action" will redirect to protectedroute and then middleware activate and redirect back to openroute. However, the URL changes to protectedroute

Expected Behavior:

• if you are not authenticated (no cookie is set), the "URL" should not change when clicking on the "redirect to protected route using server action" button.

Provide environment information

Operating System:
  Platform: win32
  Arch: x64
  Version: Windows 11 Enterprise
  Available memory (MB): 32579
  Available CPU cores: 12
Binaries:
  Node: 22.5.1
  npm: N/A
  Yarn: N/A
  pnpm: N/A
Relevant Packages:
  next: 14.2.14 // Latest available version is detected (14.2.14).
  eslint-config-next: 14.2.14
  react: 18.3.1
  react-dom: 18.3.1
  typescript: 5.6.2
Next.js Config:
  output: N/A

Which area(s) are affected? (Select all that apply)

Middleware, Navigation, Performance

Which stage(s) are affected? (Select all that apply)

next dev (local), next build (local), next start (local), Other (Deployed)

Additional context

I tested the app with dev, build and production environment. The issue exists in all of them

[abhi12299]

To add more context, this is fixed in the latest canary - I believe a backport should fix this in v14.2

[ehsanrezaeee]

To add more context, this is fixed in the latest canary - I believe a backport should fix this in v14.2

its a little bit urgent and i dont think canary will be stable soon. but thanks. i have another issue that solved with canary version 14.3 but they didnt release it as well