diff --git a/docs/references/nextjs/auth-middleware.mdx b/docs/references/nextjs/auth-middleware.mdx index 5cf885cf4a..ec8d5f9c74 100644 --- a/docs/references/nextjs/auth-middleware.mdx +++ b/docs/references/nextjs/auth-middleware.mdx @@ -247,7 +247,6 @@ The `authMiddleware()` method accepts an optional object. The following options | ---------------------------------- | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `afterAuth?` | `function` | Called after the authentication middleware is executed. This function has access to the [`Authentication`](/docs/references/nextjs/authentication-object) object and can be used to execute logic based on the auth state. | | `apiRoutes?` | `string[]` | A list of routes that should return 401 if the user is not logged in. You can use glob patterns to match multiple routes or a function to match against the request object. For example: `['/foo', '/bar(.*)']` or `[/^\/foo\/.*$/]` | -| `audience?` | `string \| string[]` | A string or list of audiences. | | `audience?` | `string \| string[]` | A string or list of [audiences](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3). If passed, it is checked against the `aud` claim in the token. | | `authorizedParties?` | `string[]` | An allowlist of origins to verify against, to protect your application from the subdomain cookie leaking attack.
For example:
`['http://localhost:3000', 'https://example.com']`
For more information, refer to the [reference guide](/docs/references/nodejs/token-verification#validate-the-authorized-party-of-a-session-token). | | `beforeAuth?` | `function` | A function called before the authentication middleware is executed. If a redirect response is returned, the middleware will respect it and redirect the user. If `false` is returned, the auth middleware will not execute and the request will be handled as if the auth middleware was not present. |