JavaScript is making me rip myself

I am working on a next js project with auth js.

I am using Google login only.

Once the user is logged in I want them to set a username so in my middleware I have added a condition if the "username" cookie does not exist then send the user to update-username route where he can add the username, which then stores the cookie and the flow is working.

But what if the username is not set in the database and someone just manually adds a cookie via inspect element then they are able to use the app without actually adding a username.

How does someone handle this problem without making any API call on every route change?

I thought I'd handle this in the server side but you can't set cookies on the server component in next js.

Please if anyone can help with this issue it would be great.

Thanks

Edit - I have implemented a token flow and now I use a totally different cookie to store additional information, I don't store it in the auth js token anymore which kinda works for me since it's a very small application and I don't want to waste time in things which don't matter a lot.