How does the request lifecycle work in Laravel?

Question

IT Interview Practice · Accepted Answer

Every Laravel request enters through a single front controller, `public/index.php`, is driven by the **HTTP Kernel** through a **middleware** stack and the **router** to a **controller**, and returns a `Response` — after which **terminable** middleware runs.

## The stages

```
public/index.php  ── autoload + bootstrap the app
   ▼
HTTP Kernel::handle($request)
   ▼
Bootstrappers  ── env, config, providers (register + boot)
   ▼
Global middleware  ── (TrustProxies, HandleCors, ...)
   ▼
Router dispatch  ── match route
   ▼
Route / group middleware  ── (auth, throttle, verified, ...)
   ▼
Controller (or closure)  ── your logic → returns a Response
   ▼
Response ──▶ client
   ▼
Kernel::terminate  ── terminable middleware (e.g. session save, logging)
```

1. **Front controller** — `index.php` loads Composer autoload and bootstraps the application container.
2. **Kernel::handle** — the HTTP Kernel receives the `Request` and runs the **bootstrappers**: load env + config, register and **boot** service providers (this is where the framework and your bindings wire up).
3. **Global middleware** — runs for every request (CORS, maintenance mode, trimming strings, proxy trust).
4. **Routing** — the router matches the URI + verb to a route.
5. **Route/group middleware** — middleware assigned to the route or its group (`auth`, `throttle`, `verified`) runs before the controller; each can short-circuit.
6. **Controller** — your action (or route closure) runs, uses models/services, and returns a `Response` (view, JSON, redirect). Middleware "after" logic runs as the response bubbles back out.
7. **terminate** — after the response is sent, `Kernel::terminate` runs terminable middleware for deferred work.

```php
// app/Http/Middleware/Timing.php  → 3/5. middleware
public function handle($request, Closure $next)
{
    $request->attributes->set('started', microtime(true));
    $response = $next($request);          // pass to next layer / controller
    $response->headers->set('X-Time', '...');  // "after" logic
    return $response;
}

// routes/web.php  → 4. routing (+ middleware)
Route::get('/items/{id}', [ItemController::class, 'show'])->middleware('auth');

// app/Http/Controllers/ItemController.php  → 6. controller
public function show(int $id)
{
    return response()->json(Item::findOrFail($id));
}
```

## Why it matters

Laravel's lifecycle is built around the **service container** and **middleware pipeline**, so knowing the order — bootstrap/providers, then global middleware, then routing, then route middleware, then controller, then `terminate` — tells you exactly where auth, rate limiting, CORS, and cleanup belong. It explains why a service must be bound in a provider before it's injected, why `throttle` rejects a request before your controller runs, and how to defer slow work to terminable middleware so the user isn't kept waiting.

The stages

Why it matters

Related questions