How to Order Middleware in Django: Correct Setup and Tips

In Django, middleware order matters because each middleware processes requests and responses in sequence. You set the order by listing middleware classes in the MIDDLEWARE setting in settings.py, where the first middleware handles the request first and the last middleware handles the response first.

Syntax

The MIDDLEWARE setting in settings.py is a list of middleware classes. Django processes this list in order for requests and in reverse order for responses.

• Request phase: Middleware at the top runs first.
• Response phase: Middleware at the bottom runs first.

This order controls how your app handles incoming requests and outgoing responses.

python

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

Example

This example shows a custom middleware added to the default Django middleware list. The order ensures the custom middleware processes requests after session setup but before authentication.

python

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'myapp.middleware.CustomMiddleware',  # Custom middleware added here
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

# CustomMiddleware example

from django.utils.deprecation import MiddlewareMixin

class CustomMiddleware(MiddlewareMixin):
    def process_request(self, request):
        print('CustomMiddleware: processing request')

    def process_response(self, request, response):
        print('CustomMiddleware: processing response')
        return response

Output

CustomMiddleware: processing request
CustomMiddleware: processing response

Common Pitfalls

Common mistakes when ordering middleware include:

• Placing middleware that depends on sessions before SessionMiddleware.
• Putting authentication middleware before session middleware, causing authentication to fail.
• Adding custom middleware in the wrong order, breaking request or response flow.

Always check middleware dependencies and Django docs for recommended order.

python

MIDDLEWARE = [
    'django.contrib.auth.middleware.AuthenticationMiddleware',  # Wrong: before sessions
    'django.contrib.sessions.middleware.SessionMiddleware',
]

# Correct order:
MIDDLEWARE = [
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
]

Quick Reference

Middleware Type	Recommended Order Position	Reason
SecurityMiddleware	First	Sets security headers early
SessionMiddleware	Before AuthenticationMiddleware	Sessions needed for authentication
AuthenticationMiddleware	After SessionMiddleware	Depends on session data
CommonMiddleware	After SessionMiddleware	Handles common tasks like URL rewriting
CsrfViewMiddleware	After AuthenticationMiddleware	Protects authenticated views
MessageMiddleware	After AuthenticationMiddleware	Handles user messages
Clickjacking Middleware	Last	Sets headers on final response

Key Takeaways

Order middleware in the MIDDLEWARE list in settings.py to control request and response flow.

Middleware at the top processes requests first and responses last; order matters for dependencies.

Place SessionMiddleware before AuthenticationMiddleware to avoid errors.

Add custom middleware carefully respecting dependencies and order.

Refer to Django docs for recommended middleware order to ensure correct app behavior.