Middleware and Request Lifecycle

# CHAPTER 13

Middleware and Request Lifecycle #

1. Introduction #

2. Learning Objectives #

• Define the role of Middleware in the HTTP request lifecycle.

• Apply existing middleware (like auth) to routes.

• Create custom Middleware using Artisan.

• Understand the difference between global and route-specific middleware.

3. Beginner-Friendly Explanation #

• Layer 1 (CSRF Middleware): Checks if the request has a valid security token. If not, rejects it.

• Layer 2 (Auth Middleware): Checks if the user is logged in. If not, redirects them to the login page.

• Layer 3 (Custom Age Middleware): Checks if the user is over 18. If not, redirects them to a "Too Young" page.

4. Using Built-in Middleware #

Protecting a single route:

Route::get('/dashboard', [DashboardController::class, 'index'])->middleware('auth');

Protecting a group of routes: If you have an Admin panel with 20 pages, you don't want to type ->middleware('auth') 20 times. Group them!

Route::middleware(['auth'])->group(function () {
    Route::get('/admin/users', [AdminController::class, 'users']);
    Route::get('/admin/settings', [AdminController::class, 'settings']);
    Route::post('/admin/delete', [AdminController::class, 'destroy']);
});

5. Creating Custom Middleware #

Step 1: Generate the file via Artisan

php artisan make:middleware IsAdmin

Step 2: Write the logic (app/Http/Middleware/IsAdmin.php)

<?php
namespace App\Http\Middleware;
use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;

class IsAdmin
{
    public function handle(Request $request, Closure $next)
    {
        // Check if user is logged in AND their role is 'admin'
        if (Auth::check() && Auth::user()->role == &#039;admin') {
            // PASS: Send the request deeper into the onion (to the Controller)
            return $next($request); 
        }

        // FAIL: Kick them out to the homepage with an error
        return redirect(&#039;/')->with('error', 'You do not have Admin access.');
    }
}

6. Registering Custom Middleware (Laravel 10 and below) #

protected $routeMiddleware = [
    'auth' => \App\Http\Middleware\Authenticate::class,
    'admin' => \App\Http\Middleware\IsAdmin::class, // Our new nickname
];

Now, apply it in web.php:

// The user must pass BOTH the auth layer and the admin layer!
Route::get('/admin/dashboard', function() {
    return "Secret Admin Area";
})->middleware(['auth', 'admin']);

7. Global vs. Route Middleware #

• Route Middleware: Only applies to routes where you explicitly type ->middleware('name'). (e.g., auth, admin).

• Global Middleware: Runs on EVERY single request entering your application, no matter the route. (e.g., TrimStrings, VerifyCsrfToken). You don't want to run auth globally, or no one could view your public homepage!

8. Backend Workflow: Request Modification #

9. Best Practices #

• Keep Middleware Lightweight: Because Global Middleware runs on *every single click* your server processes, do not put heavy database queries inside them. It will drastically slow down your entire application.

10. Common Mistakes #

• Infinite Redirect Loops: If your auth middleware redirects failed users to /login, but you accidentally put the auth middleware ON the /login route itself... the user will be bounced back and forth infinitely until the browser crashes. Never put authentication middleware on public login routes.

11. Exercises #

1. 1. Explain the "Onion Analogy" regarding how an HTTP request travels through Middleware before reaching a Controller.

12. Coding Challenges #

• Challenge: Explain the conceptual logic of writing an AgeRestricted middleware. If a request has a parameter ?age=15, how would the handle() method block the request? What function allows the request to proceed if age=21?

13. MCQs with Answers #

14. Interview Questions #

• Q: Describe the difference between Global Middleware and Route Middleware. Provide an example of a built-in Laravel middleware that functions as Global.

• Q: Walk me through the implementation of a custom Middleware designed to check user roles (e.g., Admin vs Standard User). How is it registered and applied to a route group?

15. FAQs #

16. Summary #

17. Next Chapter Recommendation #