From 227dee4a537fc509b9b880b6b79437753eef330b Mon Sep 17 00:00:00 2001
From: Jos Vooges | STH <jos@sthbv.nl>
Date: Thu, 3 Sep 2026 02:05:51 +0200
Subject: [PATCH] Ignore bogus Next-Action probes that spam admin-ui logs.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 apps/admin-ui/src/middleware.ts | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 apps/admin-ui/src/middleware.ts

diff --git a/apps/admin-ui/src/middleware.ts b/apps/admin-ui/src/middleware.ts
new file mode 100644
index 0000000..a6353ac
--- /dev/null
+++ b/apps/admin-ui/src/middleware.ts
@@ -0,0 +1,24 @@
+import { NextRequest, NextResponse } from "next/server";
+
+/**
+ * Admin UI uses client-side fetch only — no Server Actions.
+ * Bots/scanners probe with Next-Action headers ("action", "x", "0", …)
+ * and spam Next.js logs. Reject those early without logging noise.
+ */
+export function middleware(request: NextRequest) {
+  const actionId = request.headers.get("next-action");
+  if (actionId) {
+    return new NextResponse(null, { status: 404 });
+  }
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: [
+    /*
+     * Run on all paths except static assets and the API proxy.
+     * API proxy must stay untouched for real admin traffic.
+     */
+    "/((?!api|_next/static|_next/image|favicon.ico|sw.js|manifest.webmanifest|icons/).*)",
+  ],
+};