Controller middleware in Laravel - Mini Project: Build & Apply

Using Controller Middleware in Laravel

📖 Scenario: You are building a simple Laravel web application that has a controller to manage user profiles. You want to protect the profile routes so that only authenticated users can access them.

🎯 Goal: Create a controller called UserProfileController and apply the built-in auth middleware to it. This will ensure only logged-in users can access the controller's methods.

📋 What You'll Learn

Create a controller named UserProfileController

Add the auth middleware to the controller's constructor

Create a method show that returns a simple string

Ensure the middleware protects all methods in the controller

💡 Why This Matters

🌍 Real World

Middleware is commonly used in Laravel to protect routes and controllers, ensuring only authorized users can access certain parts of a web application.

💼 Career

Understanding how to apply middleware in Laravel controllers is essential for backend developers working with Laravel to build secure web applications.

1

Create the UserProfileController

Create a controller class named UserProfileController inside the App\Http\Controllers namespace. Add a public method called show that returns the string 'User Profile Page'.

Laravel

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;

class UserProfileController extends Controller
{
    // Your code here
}

Hint

Remember to define the class inside the correct namespace and add the show method that returns the exact string.

2

Add the auth middleware in the constructor

Inside the UserProfileController class, add a constructor method __construct. In this constructor, apply the auth middleware using $this->middleware('auth');.

Laravel

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;

class UserProfileController extends Controller
{
    public function __construct()
    {
        // Your code here
    }

    public function show()
    {
        return 'User Profile Page';
    }
}

Hint

The constructor method is named __construct. Use $this->middleware('auth'); inside it to apply the middleware.

3

Add a second method to demonstrate middleware protection

Add a public method named edit inside UserProfileController that returns the string 'Edit User Profile'. This method will also be protected by the auth middleware.

Laravel

middleware('auth');
    }

    public function show()
    {
        return 'User Profile Page';
    }

    // Your code here
}

Hint

Define the edit method similar to show, returning the exact string.

4

Complete the controller with middleware protecting all methods

Ensure the UserProfileController class has the auth middleware applied in the constructor and includes both show and edit methods returning their respective strings. This completes the controller setup with middleware protection.

Laravel

middleware('auth');
    }

    public function show()
    {
        return 'User Profile Page';
    }

    public function edit()
    {
        return 'Edit User Profile';
    }

    // Your code here if needed
}

Hint

Review the controller to confirm the middleware is applied and both methods are present with correct return values.

Practice

1. What is the main purpose of middleware in a Laravel controller?

easy

A. To connect the controller to the database

B. To define routes for the controller

C. To run code before or after controller methods for access control or modification

D. To create views for the controller

Solution

1. Step 1: Understand middleware role

   Middleware acts as a filter that runs before or after controller methods to control access or modify requests/responses.

2. Step 2: Differentiate from other controller tasks

   Defining routes, connecting to databases, or creating views are not middleware responsibilities.

3. Final Answer:

   To run code before or after controller methods for access control or modification -> Option C

4. Quick Check:

   Middleware controls access and actions around controller methods = A [OK]

Hint: Middleware filters requests before/after controller methods [OK]

Common Mistakes:

• Confusing middleware with routing
• Thinking middleware creates views
• Assuming middleware connects to database

2. Which is the correct way to add middleware to a Laravel controller constructor?

easy

A. $this->middleware('auth');

B. middleware->add('auth');

C. addMiddleware('auth');

D. useMiddleware('auth');

Solution

1. Step 1: Recall Laravel middleware syntax

   In Laravel controllers, middleware is added inside the constructor using $this->middleware('name');.

2. Step 2: Check other options for syntax correctness

   Options A, C, and D do not follow Laravel's middleware syntax and will cause errors.

3. Final Answer:

   $this->middleware('auth'); -> Option A

4. Quick Check:

   Use $this->middleware() in constructor = B [OK]

Hint: Use $this->middleware('name') inside constructor [OK]

Common Mistakes:

• Using incorrect method names
• Calling middleware outside constructor
• Missing $this keyword

3. Given this controller constructor code:

public function __construct() {
    $this->middleware('auth')->only('edit', 'update');
}

Which methods will have the 'auth' middleware applied?

medium

A. Only the edit and update methods

B. All methods except edit and update

C. All methods in the controller

D. No methods, syntax error

Solution

1. Step 1: Understand the use of only() method

   The only('edit', 'update') limits middleware to run only on these two methods.

2. Step 2: Confirm middleware application

   Middleware 'auth' applies only to 'edit' and 'update', other methods are unaffected.

3. Final Answer:

   Only the edit and update methods -> Option A

4. Quick Check:

   only() limits middleware to specified methods = D [OK]

Hint: only() applies middleware to listed methods only [OK]

Common Mistakes:

• Confusing only() with except()
• Assuming middleware applies to all methods
• Thinking syntax causes error

4. Identify the error in this controller constructor:

public function __construct() {
    $this->middleware('auth')->except('index', 'show');
    $this->middleware('log');
}

medium

A. Middleware 'log' will override 'auth' middleware

B. You cannot call middleware twice in constructor

C. except() method requires array, not multiple arguments

D. No error; both middleware apply correctly

Solution

1. Step 1: Check multiple middleware calls

   Laravel allows multiple middleware calls in constructor; they stack and apply in order.

2. Step 2: Validate except() usage

   except() accepts multiple string arguments or an array; both are valid.

3. Final Answer:

   No error; both middleware apply correctly -> Option D

4. Quick Check:

   Multiple middleware calls and except() usage are valid = C [OK]

Hint: Multiple middleware calls stack; except() accepts multiple args [OK]

Common Mistakes:

• Thinking multiple middleware calls override each other
• Assuming except() needs array only
• Believing syntax causes error

5. You want to apply the 'verified' middleware to all controller methods except 'index' and 'show', and also apply 'log' middleware only to 'store' and 'update'. Which constructor code correctly implements this using arrays?

hard

A. public function __construct() {
$this->middleware('verified')->only('index', 'show');
$this->middleware('log')->except('store', 'update');
}

B. public function __construct() {
$this->middleware('verified')->except(['index', 'show']);
$this->middleware('log')->only(['store', 'update']);
}

C. public function __construct() {
$this->middleware('verified');
$this->middleware('log');
}

D. public function __construct() {
$this->middleware('verified')->except('index', 'show');
$this->middleware('log')->only('store', 'update');
}

Solution

1. Step 1: Apply 'verified' middleware except on 'index' and 'show'

   Use except() with array to exclude 'index' and 'show' from 'verified' middleware.

2. Step 2: Apply 'log' middleware only on 'store' and 'update'

   Use only() with array to limit 'log' middleware to 'store' and 'update' methods.

3. Step 3: Compare options

   public function __construct() { $this->middleware('verified')->except('index', 'show'); $this->middleware('log')->only('store', 'update'); } uses except() and only() with multiple string arguments (valid but less common). public function __construct() { $this->middleware('verified')->except(['index', 'show']); $this->middleware('log')->only(['store', 'update']); } uses arrays which is clearer and recommended. Options B and C do not match requirements.

4. Final Answer:

   public function __construct() { $this->middleware('verified')->except(['index', 'show']); $this->middleware('log')->only(['store', 'update']); } -> Option B

5. Quick Check:

   Use except() and only() with arrays for clarity = A [OK]

Hint: Use except() and only() with arrays for multiple methods [OK]

Common Mistakes:

• Mixing only() and except() incorrectly
• Not using arrays for multiple methods
• Applying middleware to wrong methods