Not able to protect auth route

import { NextResponse } from "next/server";
import type { NextRequest } from "next/server";
import { getKindeServerSession} from "@kinde-oss/kinde-auth-nextjs/server";

export async function middleware(request: NextRequest) {
const session = getKindeServerSession();

// Check if the user is authenticated
if (!(await session.isAuthenticated())) {
return NextResponse.redirect(
new URL("/api/auth/login?post_login_redirect_url=/dashboard", request.url)
);
}

return NextResponse.next();
}

export const config = {
matcher: [
'/((?!api|aboutus|_next/static|_next/image|favicon.ico|sitemap.xml|robots.txt|$).*)',
],
}


when user is not authenticated then also it is able to access the route