Middleware

Lesson 1 of 17 Advanced Interactive

Middleware filters HTTP requests. Use for auth, logging, CORS, etc.

Types

Global � every request
Route � specific routes
Custom � your own

Syntax

LARAVEL

Route::get("/dashboard", fn() => view("dashboard"))->middleware("auth");

Route::middleware(["auth", "verified"])->group(function () {
    Route::get("/profile", ...);
    Route::put("/profile", ...);
});

Laravel Middleware

PHP

<?php
// app/Http/Middleware/EnsureUserIsAdmin.php
namespace App\Http\Middleware;

use Closure;

class EnsureUserIsAdmin
{
    public function handle($request, Closure $next)
    {
        if (!$request->user() || !$request->user()->is_admin) {
            abort(403, "Admin only.");
        }

        return $next($request);
    }
}

// Register in bootstrap/app.php (Laravel 11)
$app->middleware->alias([
    "admin" => EnsureUserIsAdmin::class,
]);

// routes/web.php
Route::middleware("auth:student")->group(function () {
    Route::get("/dashboard", [DashboardController::class, "index"]);
});

Route::middleware(["auth", "admin"])->group(function () {
    Route::resource("/admin", AdminController::class);
});

Try It Yourself

Practice

Exercise

Create a middleware that checks if user is admin.

Answer

class AdminMiddleware {
    public function handle($request, Closure $next) {
        if (auth()->user()->role !== "admin") abort(403);
        return $next($request);
    }
}

Quick Quiz

What does middleware("auth") do?

Logs user in

Checks if authenticated

Registers user

Auth middleware checks if the user is logged in.

Interview Questions

Middleware forms a pipeline. Request passes through each layer which can modify, forward, or reject it.

Next Lesson

API Routes