diff --git a/actions/admin.ts b/actions/admin.ts
index 4db6309..e7f3842 100644
--- a/actions/admin.ts
+++ b/actions/admin.ts
@@ -1,8 +1,7 @@
 'use server';
 
-import { createServerClient } from '@supabase/ssr';
 import { createClient } from '@supabase/supabase-js';
-import { cookies } from 'next/headers';
+import { requireAdmin } from '@/lib/auth';
 
 async function getAdminSupabase() {
   const url = process.env.NEXT_PUBLIC_SUPABASE_URL!;
@@ -14,42 +13,15 @@ async function getAdminSupabase() {
 }
 
 async function assertAdmin() {
-  const cookieStore = await cookies();
-  const supabase = createServerClient(
-    process.env.NEXT_PUBLIC_SUPABASE_URL!,
-    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
-    {
-      cookies: { get: (name) => cookieStore.get(name)?.value },
-    }
-  );
-
-  const {
-    data: { session },
-  } = await supabase.auth.getSession();
-
-  if (!session) throw new Error('Unauthorized');
-
-  const { data: profile } = await supabase
-    .from('users')
-    .select('user_role')
-    .eq('id', session.user.id)
-    .maybeSingle();
-
-  const role = profile?.user_role;
-  const isAdmin =
-    role === 'admin' ||
-    role === 'superadmin' ||
-    session.user.email === 'deepaksharma834@gmail.com';
-
-  if (!isAdmin) throw new Error('Forbidden');
+  await requireAdmin();
 }
 
 // Table mapping based on experience type
-const TABLE_MAP: Record<string, string> = {
+const TABLE_MAP = {
   user: 'new_interview',
   scraped: 'scraped_experiences',
   legacy: 'experiences',
-};
+} as const satisfies Record<string, string>;
 
 export async function deleteExperience(
   rawId: string,
diff --git a/app/admin/page.tsx b/app/admin/page.tsx
index cf8cc3f..f6e058e 100644
--- a/app/admin/page.tsx
+++ b/app/admin/page.tsx
@@ -1,8 +1,7 @@
 import AdminDashboard from '@/components/admin-dashboard';
-import { createServerClient } from '@supabase/ssr';
-import { cookies } from 'next/headers';
 import type { Metadata } from 'next';
 import { redirect } from 'next/navigation';
+import { getAuthState } from '@/lib/auth';
 
 export const metadata: Metadata = {
   title: 'Admin Panel | Frontend Junction',
@@ -11,37 +10,9 @@ export const metadata: Metadata = {
 };
 
 export default async function AdminPage() {
-  const cookieStore = await cookies();
-  const supabase = createServerClient(
-    process.env.NEXT_PUBLIC_SUPABASE_URL!,
-    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
-    {
-      cookies: {
-        get(name: string) {
-          return cookieStore.get(name)?.value;
-        },
-      },
-    }
-  );
+  const { isAdmin } = await getAuthState();
 
-  const {
-    data: { session },
-  } = await supabase.auth.getSession();
-
-  if (!session) {
-    redirect('/');
-  }
-
-  const { data: userProfile } = await supabase
-    .from('users')
-    .select('user_role')
-    .eq('id', session.user.id)
-    .maybeSingle();
-
-  if (
-    userProfile?.user_role !== 'admin' &&
-    userProfile?.user_role !== 'superadmin'
-  ) {
+  if (!isAdmin) {
     redirect('/');
   }
 
diff --git a/app/api/admin/stats/route.ts b/app/api/admin/stats/route.ts
index d494026..b6a69e1 100644
--- a/app/api/admin/stats/route.ts
+++ b/app/api/admin/stats/route.ts
@@ -1,35 +1,10 @@
-import { createServerClient } from '@supabase/ssr';
-import { cookies } from 'next/headers';
 import { NextResponse } from 'next/server';
+import { requireAdmin, AuthError } from '@/lib/auth';
 
 export async function GET() {
   try {
-    const cookieStore = await cookies();
-    const supabase = createServerClient(
-      process.env.NEXT_PUBLIC_SUPABASE_URL!,
-      process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
-      {
-        cookies: {
-          get(name: string) {
-            return cookieStore.get(name)?.value;
-          },
-        },
-      }
-    );
-
-    // 1. Check if user is logged in
-    const {
-      data: { session },
-    } = await supabase.auth.getSession();
-    if (!session) {
-      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
-    }
-
-    // 2. Check for Admin role (Hardcoded for current MVP, same as session-provider)
-    const isAdmin = session.user.email === 'deepaksharma834@gmail.com';
-    if (!isAdmin) {
-      return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
-    }
+    // Consistent admin gate (dual rule, verified user)
+    await requireAdmin();
 
     const url = process.env.NEXT_PUBLIC_SUPABASE_URL;
     const key = process.env.SUPABASE_SERVICE_ROLE_KEY;
@@ -102,6 +77,9 @@ export async function GET() {
       successRate,
     });
   } catch (error: any) {
+    if (error instanceof AuthError) {
+      return NextResponse.json({ error: error.message }, { status: error.status });
+    }
     console.error('[AdminStatsAPI] Error:', error);
     return NextResponse.json({ error: error.message }, { status: 500 });
   }
diff --git a/app/api/auth/me/route.ts b/app/api/auth/me/route.ts
new file mode 100644
index 0000000..cbdb80b
--- /dev/null
+++ b/app/api/auth/me/route.ts
@@ -0,0 +1,14 @@
+import { NextResponse } from 'next/server';
+import { getAuthState } from '@/lib/auth';
+
+// Never cache — this reflects per-request session state.
+export const dynamic = 'force-dynamic';
+export const revalidate = 0;
+
+export async function GET() {
+  const { isAdmin, role } = await getAuthState();
+  return NextResponse.json(
+    { isAdmin, role: role ?? null },
+    { headers: { 'Cache-Control': 'no-store, max-age=0' } }
+  );
+}
diff --git a/app/layout.tsx b/app/layout.tsx
index 7d1983e..d6d2832 100644
--- a/app/layout.tsx
+++ b/app/layout.tsx
@@ -46,6 +46,9 @@ export const metadata: Metadata = {
   publisher: 'Frontend Junction',
   alternates: {
     canonical: '/',
+    types: {
+      'application/rss+xml': '/feed.xml',
+    },
   },
   formatDetection: {
     email: false,
@@ -122,14 +125,14 @@ export default function RootLayout({
       </head>
       {process.env.NEXT_GOOGLE_ANALYTICS && (
         <Script
-          strategy='afterInteractive'
+          strategy='lazyOnload'
           src={`https://www.googletagmanager.com/gtag/js?id=${process.env.NEXT_GOOGLE_ANALYTICS}`}
         />
       )}
       {process.env.NEXT_GOOGLE_ANALYTICS && (
         <Script
           id='google-analytics'
-          strategy='afterInteractive'
+          strategy='lazyOnload'
           dangerouslySetInnerHTML={{
             __html: `
             window.dataLayer = window.dataLayer || [];
diff --git a/components/common/profile.tsx b/components/common/profile.tsx
index 0660fbd..4eebc24 100644
--- a/components/common/profile.tsx
+++ b/components/common/profile.tsx
@@ -9,24 +9,13 @@ import { usePathname } from 'next/navigation';
 import Image from 'next/image';
 import { Button } from '@/components/ui/button';
 import Link from 'next/link';
-import { getSupabaseBrowserClient } from '@/lib/supabase-browser';
 import { useAuth } from '../session-provider';
-import { useRouter } from 'next/navigation';
 
 export default function Profile() {
-  const router = useRouter();
   const path = usePathname();
-  const supabase = getSupabaseBrowserClient();
-  const { user = null, setUser } = useAuth();
+  const { user = null } = useAuth();
 
-  const handleLogout = async () => {
-    await supabase.auth.signOut();
-    setUser(null);
-    router.push('/');
-  };
-
-  const isAdmin = user?.role === 'admin';
-  const isSub = user?.stripe_customer_id;
+  const isAdmin = user?.role === 'admin' || user?.role === 'superadmin';
 
   return (
     <Popover>
diff --git a/content/blog/images/blog_accessibility-best-practices-every-frontend-develo.png b/content/blog/images/blog_accessibility-best-practices-every-frontend-develo.png
new file mode 100644
index 0000000..277ffdd
Binary files /dev/null and b/content/blog/images/blog_accessibility-best-practices-every-frontend-develo.png differ
diff --git a/content/blog/images/blog_frontend-architecture-patterns-building-maintainab.png b/content/blog/images/blog_frontend-architecture-patterns-building-maintainab.png
new file mode 100644
index 0000000..ab28a00
Binary files /dev/null and b/content/blog/images/blog_frontend-architecture-patterns-building-maintainab.png differ
diff --git a/content/blog/images/blog_frontend-testing-strategies-that-actually-work-in-.png b/content/blog/images/blog_frontend-testing-strategies-that-actually-work-in-.png
new file mode 100644
index 0000000..a567835
Binary files /dev/null and b/content/blog/images/blog_frontend-testing-strategies-that-actually-work-in-.png differ
diff --git a/content/blog/images/blog_react-performance-optimization-a-practical-guide-f.png b/content/blog/images/blog_react-performance-optimization-a-practical-guide-f.png
new file mode 100644
index 0000000..f28870e
Binary files /dev/null and b/content/blog/images/blog_react-performance-optimization-a-practical-guide-f.png differ
diff --git a/content/blog/images/blog_react-server-components-in-2026-a-practical-guide.png b/content/blog/images/blog_react-server-components-in-2026-a-practical-guide.png
new file mode 100644
index 0000000..6717d16
Binary files /dev/null and b/content/blog/images/blog_react-server-components-in-2026-a-practical-guide.png differ
diff --git a/content/blog/images/blog_state-management-in-2026-signals-simplicity-and-th.png b/content/blog/images/blog_state-management-in-2026-signals-simplicity-and-th.png
new file mode 100644
index 0000000..dc76ce7
Binary files /dev/null and b/content/blog/images/blog_state-management-in-2026-signals-simplicity-and-th.png differ
diff --git a/lib/auth.ts b/lib/auth.ts
new file mode 100644
index 0000000..9a9acde
--- /dev/null
+++ b/lib/auth.ts
@@ -0,0 +1,115 @@
+import 'server-only';
+import { createServerClient, type CookieOptions } from '@supabase/ssr';
+import { cookies } from 'next/headers';
+import type { SupabaseClient, User } from '@supabase/supabase-js';
+
+const ADMIN_ROLES = ['admin', 'superadmin'] as const;
+
+export interface AuthState {
+  user: User | null;
+  role: string | null;
+  isAdmin: boolean;
+}
+
+export class AuthError extends Error {
+  status: number;
+  constructor(message: string, status: number) {
+    super(message);
+    this.name = 'AuthError';
+    this.status = status;
+  }
+}
+
+/**
+ * The single server-side Supabase client factory.
+ * Full cookie read/write so session refresh works in route handlers
+ * and server actions. (In Server Components, writes are no-ops — that's fine,
+ * middleware refreshes the session.)
+ */
+export async function getServerSupabase(): Promise<SupabaseClient> {
+  const cookieStore = await cookies();
+  return createServerClient(
+    process.env.NEXT_PUBLIC_SUPABASE_URL!,
+    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
+    {
+      cookies: {
+        get(name: string) {
+          return cookieStore.get(name)?.value;
+        },
+        set(name: string, value: string, options: CookieOptions) {
+          try {
+            cookieStore.set({ name, value, ...options });
+          } catch {
+            /* called from a Server Component — middleware handles refresh */
+          }
+        },
+        remove(name: string, options: CookieOptions) {
+          try {
+            cookieStore.set({ name, value: '', ...options });
+          } catch {
+            /* called from a Server Component */
+          }
+        },
+      },
+    }
+  );
+}
+
+/**
+ * Returns the verified user (validated against the Supabase Auth server via
+ * getUser()). Use this for ALL authorization decisions — never getSession(),
+ * which only reads the (potentially forged) cookie without verifying the JWT.
+ */
+export async function getVerifiedUser(
+  client?: SupabaseClient
+): Promise<User | null> {
+  const supabase = client ?? (await getServerSupabase());
+  const {
+    data: { user },
+    error,
+  } = await supabase.auth.getUser();
+  if (error) return null;
+  return user;
+}
+
+/**
+ * Resolves the full auth state with the canonical admin rule:
+ * admin if app_metadata.role OR users.user_role is in {admin, superadmin}.
+ * This is the ONE place role resolution lives.
+ */
+export async function getAuthState(): Promise<AuthState> {
+  const supabase = await getServerSupabase();
+  const user = await getVerifiedUser(supabase);
+
+  if (!user) {
+    return { user: null, role: null, isAdmin: false };
+  }
+
+  // 1. Prefer the role embedded in the verified JWT.
+  let role: string | null = (user.app_metadata as any)?.role ?? null;
+
+  // 2. Fall back to the users table when the JWT has no admin role.
+  if (!role || !ADMIN_ROLES.includes(role as any)) {
+    const { data: profile } = await supabase
+      .from('users')
+      .select('user_role')
+      .eq('id', user.id)
+      .maybeSingle();
+    role = profile?.user_role ?? role;
+  }
+
+  const isAdmin = role != null && ADMIN_ROLES.includes(role as any);
+  return { user, role, isAdmin };
+}
+
+/**
+ * Guard for API routes and server actions. Returns the AuthState when the
+ * caller is an admin; otherwise throws AuthError (401 if unauthenticated,
+ * 403 if authenticated but not admin).
+ */
+export async function requireAdmin(): Promise<AuthState> {
+  const state = await getAuthState();
+  if (!state.user) throw new AuthError('Unauthorized', 401);
+  if (!state.isAdmin) throw new AuthError('Forbidden', 403);
+  return state;
+}
diff --git a/middleware.ts b/middleware.ts
index 2ff45b4..e785f64 100644
--- a/middleware.ts
+++ b/middleware.ts
@@ -1,14 +1,20 @@
 import { createServerClient, type CookieOptions } from '@supabase/ssr';
 import { NextResponse, type NextRequest } from 'next/server';
 
+/**
+ * Middleware responsibilities:
+ *  1. Refresh the Supabase auth session cookie on every request.
+ *  2. Protect authenticated-only routes (currently /add-experience).
+ *
+ * Authorization for admin areas is enforced in the routes/pages themselves
+ * via lib/auth (requireAdmin / getAuthState), not here.
+ */
 export async function middleware(request: NextRequest) {
   const { pathname } = request.nextUrl;
 
-  let response = NextResponse.next({
-    request: {
-      headers: request.headers,
-    },
-  });
+  // Use a single mutable response — never reinitialise it inside callbacks
+  // or Supabase may drop multi-chunk session cookies.
+  const response = NextResponse.next({ request: { headers: request.headers } });
 
   const supabase = createServerClient(
     process.env.NEXT_PUBLIC_SUPABASE_URL!,
@@ -19,82 +25,38 @@ export async function middleware(request: NextRequest) {
           return request.cookies.get(name)?.value;
         },
         set(name: string, value: string, options: CookieOptions) {
-          request.cookies.set({
-            name,
-            value,
-            ...options,
-          });
-          response = NextResponse.next({
-            request: {
-              headers: request.headers,
-            },
-          });
-          response.cookies.set({
-            name,
-            value,
-            ...options,
-          });
+          // Write to both request and response so downstream code sees the
+          // refreshed token, and the browser receives the updated cookie.
+          request.cookies.set({ name, value, ...options });
+          response.cookies.set({ name, value, ...options });
         },
         remove(name: string, options: CookieOptions) {
-          request.cookies.set({
-            name,
-            value: '',
-            ...options,
-          });
-          response = NextResponse.next({
-            request: {
-              headers: request.headers,
-            },
-          });
-          response.cookies.set({
-            name,
-            value: '',
-            ...options,
-          });
+          request.cookies.set({ name, value: '', ...options });
+          response.cookies.set({ name, value: '', ...options });
         },
       },
     }
   );
 
-  /* Debug logging for auth */
-  // console.log(`[Middleware] Path: ${pathname}`);
-  const { data } = await supabase.auth.getSession();
+  // getUser() verifies the JWT with the auth server (secure) and triggers
+  // session refresh when the token is close to expiry, writing the new
+  // token via the set() handler above.
+  const {
+    data: { user },
+  } = await supabase.auth.getUser();
 
-  if (data.session) {
-    // console.log(`[Middleware] Session found for user: ${data.session.user.id}`);
-    // Check role safely by querying the database
-    // We only need to check role for specific protected routes or if we want to enforce admin access globally for some paths
-    // Current logic seemed to safeguard everything that wasn't /add-experience?
-    // The original logic was: if /add-experience, allow. Else check role === admin.
-    // This implies ALL other routes required admin? That seems wrong for a public site.
-    // Reviewing config matcher: ['/dashboard/:path*', '/add-experience']
-
-    if (pathname.startsWith('/dashboard')) {
-      // Dashboard is likely admin only
-      const { data: userProfile } = await supabase
-        .from('users')
-        .select('user_role')
-        .eq('id', data.session.user.id)
-        .single();
-
-      if (
-        userProfile?.user_role !== 'admin' &&
-        userProfile?.user_role !== 'superadmin'
-      ) {
-        return NextResponse.redirect(new URL('/', request.url));
-      }
-    }
-
-    // /add-experience is protected but allowed for any authenticated user (already handled by session check)
-    if (pathname === '/add-experience') {
-      return response;
-    }
-  } else {
-    // No session
+  // Protected route: must be signed in.
+  if (pathname === '/add-experience' && !user) {
     return NextResponse.redirect(new URL('/', request.url));
   }
+
+  return response;
 }
 
 export const config = {
-  matcher: ['/dashboard/:path*', '/add-experience'],
+  // Run on all page routes so that session tokens are refreshed site-wide.
+  // Exclude static assets, image optimisation, and Next.js internals.
+  matcher: [
+    '/((?!_next/static|_next/image|favicon.ico|.*\\.(?:svg|png|jpg|jpeg|gif|webp|ico|css|js)$).*)',
+  ],
 };
diff --git a/utils/supabase/middleware.ts b/utils/supabase/middleware.ts
deleted file mode 100644
index 7562882..0000000
--- a/utils/supabase/middleware.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-import { createServerClient } from '@supabase/ssr';
-import { type NextRequest, NextResponse } from 'next/server';
-
-const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
-const supabaseKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
-
-export const createClient = (request: NextRequest) => {
-  // Create an unmodified response
-  let supabaseResponse = NextResponse.next({
-    request: {
-      headers: request.headers,
-    },
-  });
-
-  const supabase = createServerClient(supabaseUrl!, supabaseKey!, {
-    cookies: {
-      getAll() {
-        return request.cookies.getAll();
-      },
-      setAll(cookiesToSet) {
-        cookiesToSet.forEach(({ name, value, options }) =>
-          request.cookies.set(name, value)
-        );
-        supabaseResponse = NextResponse.next({
-          request,
-        });
-        cookiesToSet.forEach(({ name, value, options }) =>
-          supabaseResponse.cookies.set(name, value, options)
-        );
-      },
-    },
-  });
-
-  return supabaseResponse;
-};