diff --git a/proxy.ts b/proxy.ts
new file mode 100644
index 0000000..35d4006
--- /dev/null
+++ b/proxy.ts
@@ -0,0 +1,15 @@
+import { NextResponse, type NextRequest } from "next/server";
+import { getSessionCookie } from "better-auth/cookies";
+
+export function proxy(request: NextRequest) {
+  // Only checks that the cookie exists; getCurrentUser() still validates it.
+  if (!getSessionCookie(request)) {
+    return NextResponse.redirect(new URL("/login", request.url));
+  }
+
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: ["/((?!api|login|_next/static|_next/image|.*\\..*).*)"],
+};