What is middleware in Laravel?

Question

Accepted Answer

**Middleware** provides a mechanism to **filter and process HTTP requests** entering your application — running code before (and optionally after) a request reaches the controller. It's used for cross-cutting concerns like authentication, logging, CORS, and rate limiting. ## How middleware works ```php age < 18) { return redirect('/home'); // BLOCK — short-circuit, don't proceed } return $next($request); // PASS the request to the next layer/controller } } ``` Middleware receives the request and a `$next` closure. Code before `$next($request)` runs on the way **in**; calling `$next` passes control onward; you can also act on the response after. Middleware can **short-circuit** (return a response without calling `$next`, e.g. blocking an unauthorized request). ## Applying middleware ```php // to a route Route::get('/admin', ...)->middleware('auth'); // to a group of routes Route::middleware(['auth', 'verified'])->group(function () { ... }); // globally (every request) — registered in the HTTP kernel / bootstrap ``` Middleware applies per-route, per-group, or globally. Multiple middleware run in sequence (a pipeline). ## Built-in middleware (Laravel provides many) ```text auth → require authentication (redirect/401 if not logged in) verified → require a verified email throttle:60,1 → rate limiting (60 requests per minute) guest → only for non-authenticated users can:update,post → authorization check + CSRF protection, CORS, etc. run as middleware automatically ``` Laravel ships with middleware for the most common needs — `auth` (the workhorse for protecting routes), rate limiting, CSRF, and more. ## Why it matters Middleware is an important Laravel concept for handling **cross-cutting concerns** cleanly — logic that should run for many requests, like authentication, authorization, logging, rate limiting, and CORS. Understanding it is essential because it's how Laravel applications filter and protect requests: the built-in **`auth` middleware** is the standard way to protect routes (requiring login), `throttle` provides rate limiting, and CSRF protection runs as middleware automatically — so middleware underpins core application security and behavior. Knowing how middleware works (the request/`$next` pipeline, the ability to short-circuit by returning a response to block requests) and how to apply it (per-route, per-group, globally) is fundamental for structuring applications correctly — putting cross-cutting logic in middleware rather than repeating it in every controller. Middleware is where Laravel handles request-level concerns that apply across many routes, making it important, frequently-used knowledge for building secure, well-structured applications — especially the auth middleware for protecting routes, which nearly every real application uses. Understanding the middleware pipeline also helps you write custom middleware for application-specific request processing.