Controller middleware in Laravel - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when middleware is applied to a Laravel controller?

Consider a Laravel controller with middleware applied in its constructor. What is the effect of this middleware on the controller's methods?

Laravel

class PostController extends Controller {
    public function __construct() {
        $this->middleware('auth');
    }

    public function index() {
        return 'Posts list';
    }

    public function show($id) {
        return "Post $id";
    }
}

A All methods in the controller require the user to be authenticated before running.

B Only the index method requires authentication; other methods are public.

C Middleware runs after the controller methods finish executing.

D Middleware is ignored when applied in the constructor.

💡 Hint

Think about when middleware runs in the request lifecycle.

Middleware applied in the controller constructor runs before any controller method. It protects all methods unless exceptions are specified.

📝 Syntax

intermediate

Which code correctly applies middleware only to specific controller methods?

You want to apply the 'auth' middleware only to the 'edit' and 'update' methods of a Laravel controller. Which code snippet does this correctly?

A

public function __construct() {
    $this->middleware('auth')->only(['edit', 'update']);
}

B

public function __construct() {
    $this->middleware('auth')->except(['edit', 'update']);
}

C

public function __construct() {
    $this->middleware('auth', ['only' => ['edit', 'update']]);
}

D

public function __construct() {
    $this->middleware(['auth'])->only('edit', 'update');
}

💡 Hint

Check the correct method chaining syntax for middleware restrictions.

The only method accepts an array of method names to apply middleware to. Option A uses the correct syntax.

🔧 Debug

advanced

Why does this middleware not run on the 'show' method?

Given this controller code, why does the 'show' method not require authentication?

Laravel

class ArticleController extends Controller {
    public function __construct() {
        $this->middleware('auth')->except('show');
    }

    public function show($id) {
        return "Article $id";
    }

    public function edit($id) {
        return "Edit Article $id";
    }
}

A Because the middleware name 'auth' is misspelled and ignored.

B Because 'show' method has its own middleware overriding the constructor middleware.

C Because middleware only runs on POST requests, and 'show' is a GET method.

D Because the middleware is set to run on all methods except 'show', so 'show' is public.

💡 Hint

Look at the except method usage in middleware.

The except method excludes specified methods from middleware. Here, 'show' is excluded, so no auth check runs for it.

❓ state_output

advanced

What is the output when middleware aborts the request?

If the 'auth' middleware aborts the request with a 403 error, what will the user see when accessing a protected controller method?

Laravel

Route::get('/dashboard', [DashboardController::class, 'index'])->middleware('auth');

class DashboardController extends Controller {
    public function index() {
        return 'Welcome to dashboard';
    }
}

A The user sees a blank page because middleware does not handle errors.

B The user sees a 403 Forbidden error page and the controller method is not executed.

C The user sees 'Welcome to dashboard' because middleware runs after the method.

D The user sees a 500 Internal Server Error because middleware crashed.

💡 Hint

Middleware can stop the request before the controller runs.

Middleware runs before the controller method. If it aborts with 403, the controller method is never called and the error page is shown.

🧠 Conceptual

expert

How does Laravel handle multiple middleware on a controller?

If a Laravel controller applies multiple middleware in its constructor like this: $this->middleware('auth'); $this->middleware('log'); In what order do these middleware run when a request hits a controller method?

A Middleware run in reverse order: 'log' first, then 'auth'.

B Middleware run in parallel, so order does not matter.

C Middleware run in the order they are added: 'auth' first, then 'log'.

D Only the last middleware added runs, earlier ones are ignored.

💡 Hint

Think about the middleware stack order in Laravel.

Laravel runs middleware in the order they are registered. The first middleware added runs first.