start-middleware

Topics in the source

• TanStack Start Middleware
• Agent Workflow (MANDATORY)
• Critical Rules (read first)
• Overview
• Architecture
• Reference Guide
• Concepts
• Templates

Covers composing cross-cutting server logic in TanStack Start with createMiddleware: request middleware vs server-function middleware, chaining via .middleware([...]), sharing context with next({ context }), passing client-to-server context with sendContext, client-side middleware (.client()), global middleware declared via createStart in src/start.ts, parameterized authorization factories, and staticFunctionMiddleware ordering. Targets @tanstack/react-start v1.169.5. Critical rules enforced: the method chain order is fixed (.middleware() → .validator() → .client() → .server()); shape-validated sendContext data is NOT authorization — always re-check access against the server-trusted session before using a client-sent value as a query key, filter, or path param; client context is never sent to the server unless explicitly opted in, and the client can lie about anything it sends; .client() runs on the server during SSR, so browser-only APIs need a typeof window guard; and staticFunctionMiddleware must always be last in the chain. Includes templates for an auth + permission-based authorization factory and for client-side middleware (headers, custom fetch, telemetry). Do NOT use this s

This is an excerpt. Refer to the complete source and its current requirements.