I am following this tutorial on Nextjs.org:

https://nextjs.org/learn/dashboard-app/adding-authentication

It uses Response.redirect inside the authorized callback:

import type { NextAuthConfig } from 'next-auth';
 
export const authConfig = {
  pages: {
    signIn: '/login',
  },
  callbacks: {
    authorized({ auth, request: { nextUrl } }) {
      const isLoggedIn = !!auth?.user;
      const isOnDashboard = nextUrl.pathname.startsWith('/dashboard');
      if (isOnDashboard) {
        if (isLoggedIn) return true;
        return false; // Redirect unauthenticated users to login page
      } else if (isLoggedIn) {
        return Response.redirect(new URL('/dashboard', nextUrl));
      }
      return true;
    },
  },
  providers: [], // Add providers with an empty array for now
} satisfies NextAuthConfig;

However, ChatGPT and Gemini both recommend not using redirect inside the authorized callback – it should only be used to determine whether the user is authorized to access that page/route.

But, given that this is the official nextjs.org tutorial – is this a valid pattern or not?

Thanks in advance!