diff --git a/apps/web/src/middleware.ts b/apps/web/src/middleware.ts
index aabc302a..b571061c 100644
--- a/apps/web/src/middleware.ts
+++ b/apps/web/src/middleware.ts
@@ -1,9 +1,22 @@
 import { NextResponse } from "next/server";
 import type { NextRequest } from "next/server";
 import { env } from "./env";
+import { getSessionCookie } from "better-auth/cookies";
 
 export async function middleware(request: NextRequest) {
   const protectedPaths = ["/editor", "/projects"];
+  const sessionCookie = getSessionCookie(request);
+
+  const canAccessProtectedPaths = (request: NextRequest) => {
+    if (env.NODE_ENV === "development") {
+      return true;
+    }
+
+    if (sessionCookie) {
+      return true;
+    }
+    return false;
+  };
 
   // Handle fuckcapcut.com domain redirect
   if (request.headers.get("host") === "fuckcapcut.com") {
@@ -12,7 +25,7 @@ export async function middleware(request: NextRequest) {
 
   const path = request.nextUrl.pathname;
 
-  if (protectedPaths.includes(path) && env.NODE_ENV === "production") {
+  if (protectedPaths.includes(path) && !canAccessProtectedPaths(request)) {
     const homeUrl = new URL("/", request.url);
     homeUrl.searchParams.set("redirect", request.url);
     return NextResponse.redirect(homeUrl);