Every signed-out request for a private page on PubTrivia gets the same treatment, and you can see it from anywhere:

$ curl -s -o /dev/null -w '%{http_code} %{redirect_url}\n' https://pub-trivia.app/dashboard 307 https://pub-trivia.app/login?next = %2Fdashboard

Enter fullscreen mode

Exit fullscreen mode

That next is deliberate. The code that writes it says what it is for:

// Unauthenticated users hitting protected routes → redirect to login, // preserving the original destination for post-login redirect. if ( ! user && ! isPublicRoute ( pathname )) { const url = request . nextUrl . clone () url . pathname = ' /login ' url . searchParams . set ( ' next ' , pathname ) return NextResponse .…