feat: Centralize authentication redirects to middleware, remove client-side redirect logic, and refine logout process.

src/app/logout/page.tsx

@@ -40,8 +40,7 @@ export default function LogoutPage() {
       localStorage.removeItem('refreshToken');
       localStorage.removeItem('user');
 
-      // Manually clear next-auth cookies as fallback
-      // next-auth v5 uses these cookie names:
+      // Manually clear non-httpOnly next-auth cookies as fallback
       const cookieNames = [
         'authjs.session-token',
         'authjs.callback-url',
@@ -59,13 +58,27 @@ export default function LogoutPage() {
         document.cookie = `${name}=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Secure`;
       });
 
-      // Use server action to properly clear session (redirects to /login)
+      // Use server action to properly clear the httpOnly session cookie.
+      // signOut() internally calls redirect() which throws NEXT_REDIRECT —
+      // Next.js handles this automatically. We should NOT catch that error.
+      // Only use fallback if the action truly fails (not a redirect throw).
       try {
         await logoutAction();
-      } catch {
-        // Server action redirect throws in Next.js — this is expected.
-        // If it truly fails, the manual cookie clearing above ensures logout.
-        // Fallback redirect:
+      } catch (error: unknown) {
+        // In Next.js App Router, redirect() throws an error with digest containing "NEXT_REDIRECT".
+        // This is normal behavior — let it propagate so Next.js handles the redirect.
+        const isRedirectError =
+          error instanceof Error &&
+          'digest' in error &&
+          typeof (error as { digest?: string }).digest === 'string' &&
+          (error as { digest: string }).digest.includes('NEXT_REDIRECT');
+
+        if (isRedirectError) {
+          // Re-throw so Next.js handles the redirect properly
+          throw error;
+        }
+
+        // Genuine error — use full page navigation as fallback
         window.location.href = '/login';
       }
     };