Middleware route matchers exposed in browser runtime

Verify canary release

• I verified that the issue exists in the latest Next.js canary release

Provide environment information

Operating System:
      Platform: darwin
      Arch: arm64
      Version: Darwin Kernel Version 22.4.0: Mon Mar  6 20:59:28 PST 2023; root:xnu-8796.101.5~3/RELEASE_ARM64_T6000
    Binaries:
      Node: 16.15.0
      npm: 8.5.5
      Yarn: 1.22.18
      pnpm: 7.22.0
    Relevant packages:
      next: 13.2.5-canary.30
      eslint-config-next: N/A
      react: 18.2.0
      react-dom: 18.2.0

Which area(s) of Next.js are affected? (leave empty if unsure)

Middleware / Edge (API routes, runtime)

Link to the code that reproduces this issue

https://github.com/vercel/next.js/tree/canary/examples/middleware

To Reproduce

1. Build the app with next build
2. Serve it with next serve.
3. Go to browser and load the website
4. Type console.log(window. __MIDDLEWARE_MATCHERS)

You will get an array of matches which show on which paths middleware runs.

In development it is exposed as __DEV_MIDDLEWARE_MATCHERS which is even fine.

Describe the Bug

I think matchers config is server side code that you do not want exposed to the client. Not sure for what it is used, so my concern is - why is it even there?

Since matcher can contain custom regex, that could contain sensitive paths/keywords.. I think that kind of code that should not be that easily accessible (or not accessible at all) could leak or be used for unwanted behaviour.

I would be curious to understand why is this needed 👀

Expected Behavior

window.__MIDDLEWARE_MATCHERS is not defined.

At very least this should be documented.

Which browser are you using? (if relevant)

No response

How are you deploying your application? (if relevant)

No response

No source file or test is named. Start with the examples/middleware reproduction and the Middleware / Edge implementation, then run next build and next serve to inspect window.__MIDDLEWARE_MATCHERS; done means the browser global is not defined in production, with development behavior considered separately.