Architecture
Why the marketing site and the app share one origin
Splitting to www. and app. is the default. It costs SEO authority, complicates cookies, and breaks attribution — and an edge router removes the reason for it.
Architecture
The usual split puts marketing on one host and the product on another, because they have genuinely different requirements: one needs to be indexed and cached hard, the other needs to be dynamic and private.
Those requirements are real. The sub-domain is not the only way to satisfy them.
What the split actually costs
Link equity earned by the product does not strengthen the marketing domain — search engines treat the two as separate sites.
Session cookies scoped to share across sub-domains widen the blast radius of an XSS on either host.
A visitor crossing from one to the other looks like a new session to most analytics pipelines, so the funnel you are trying to measure is precisely the thing that breaks.
Route at the edge instead
Middleware decides which tier owns a request before any rendering happens, and attaches the right policy for that tier. Marketing routes are statically generated and edge-cached; portal routes are dynamic, `noindex` and `no-store`.
const isPortal = isPrefixed(pathname, PORTAL_PREFIXES);
if (isPortal && !session) {
const signIn = new URL("/sign-in", request.url);
signIn.searchParams.set("next", `${pathname}${search}`); // relative only
return NextResponse.redirect(signIn);
}The trade you do have to make
A nonce-based Content Security Policy and static prerendering are mutually exclusive in Next: a prerendered page's inline bootstrap carries no nonce, so a strict policy black-holes it.
So the policy is split by tier. The portal — where a session exists — gets the strict nonce policy. The marketing and auth tiers, which hold no session and render no user input, take `'unsafe-inline'` for scripts while keeping `object-src 'none'`, `base-uri 'self'` and `frame-ancestors 'none'`.
That is a real weakening, scoped to where it costs least. It is worth naming rather than discovering later.