Controller middleware in Laravel - Step-by-Step Execution

Concept Flow - Controller middleware

Request comes in

↓

Controller Middleware

↓

Pass

↓

Controller Action

↓

Send Response

The request first hits the controller middleware which can either allow it to continue to the controller action or block it and return a response immediately.

Execution Sample

Laravel

public function __construct()
{
    $this->middleware('auth');
}

public function index()
{
    return view('dashboard');
}

This code applies the 'auth' middleware to the controller, so only authenticated users can access the index method.

Execution Table

Step	Action	Middleware Check	Result	Next Step
1	Request arrives at controller	Check 'auth' middleware	User authenticated?	Yes -> Proceed, No -> Block
2	User authenticated?	Yes	Pass middleware	Call index() method
3	Call index() method	No middleware check	Return dashboard view	Send response
4	Send response	No middleware check	Response sent to user	End
5	If user not authenticated	No	Block request	Redirect to login

💡 Execution stops when response is sent or request is blocked by middleware.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
Request	Incoming HTTP request	Checked by middleware	Passed to controller	Handled by index()	Response sent
User Authenticated	Unknown	Checked	True or False	N/A	N/A

Key Moments - 2 Insights

Why does the middleware block the request before the controller method runs?

Because middleware acts as a gatekeeper. If the user is not authenticated (see execution_table step 5), the middleware stops the request and redirects before the controller method executes.

Can middleware modify the request or response?

Yes, middleware can change the request before passing it on or modify the response before sending it back, but in this example it only checks authentication (execution_table steps 1-2).

Visual Quiz - 3 Questions

Look at the execution table, what happens at step 2 if the user is authenticated?

A The middleware passes the request to the controller

B The middleware blocks the request

C The request is redirected to login

D The response is sent immediately

💡 Hint

Check the 'Result' and 'Next Step' columns in execution_table row 2

At which step does the controller method 'index' get called?

A Step 1

B Step 3

C Step 2

D Step 4

💡 Hint

Look at the 'Action' column in execution_table row 3

If the user is not authenticated, what does the middleware do according to the execution table?

A Passes the request to the controller

B Returns the dashboard view

C Blocks the request and redirects to login

D Sends the response immediately

💡 Hint

See execution_table row 5 under 'Result' and 'Next Step'

Concept Snapshot

Controller middleware in Laravel acts as a filter for requests.
It runs before controller methods.
Middleware can allow or block requests.
Example: 'auth' middleware blocks unauthenticated users.
Middleware can redirect or modify requests/responses.
Applied in controller constructor with $this->middleware('name').

Full Transcript

In Laravel, controller middleware runs before the controller's methods. When a request arrives, the middleware checks conditions like user authentication. If the user passes the check, the request proceeds to the controller method, which then returns a response. If the user fails, the middleware blocks the request and can redirect the user, for example, to a login page. This process ensures only authorized users access certain controller actions. Middleware is applied in the controller's constructor using $this->middleware('auth'). This flow helps keep your application secure and organized.

Practice

1. What is the main purpose of middleware in a Laravel controller?

easy

A. To connect the controller to the database

B. To define routes for the controller

C. To run code before or after controller methods for access control or modification

D. To create views for the controller

Solution

1. Step 1: Understand middleware role

   Middleware acts as a filter that runs before or after controller methods to control access or modify requests/responses.

2. Step 2: Differentiate from other controller tasks

   Defining routes, connecting to databases, or creating views are not middleware responsibilities.

3. Final Answer:

   To run code before or after controller methods for access control or modification -> Option C

4. Quick Check:

   Middleware controls access and actions around controller methods = A [OK]

Hint: Middleware filters requests before/after controller methods [OK]

Common Mistakes:

• Confusing middleware with routing
• Thinking middleware creates views
• Assuming middleware connects to database

2. Which is the correct way to add middleware to a Laravel controller constructor?

easy

A. $this->middleware('auth');

B. middleware->add('auth');

C. addMiddleware('auth');

D. useMiddleware('auth');

Solution

1. Step 1: Recall Laravel middleware syntax

   In Laravel controllers, middleware is added inside the constructor using $this->middleware('name');.

2. Step 2: Check other options for syntax correctness

   Options A, C, and D do not follow Laravel's middleware syntax and will cause errors.

3. Final Answer:

   $this->middleware('auth'); -> Option A

4. Quick Check:

   Use $this->middleware() in constructor = B [OK]

Hint: Use $this->middleware('name') inside constructor [OK]

Common Mistakes:

• Using incorrect method names
• Calling middleware outside constructor
• Missing $this keyword

3. Given this controller constructor code:

public function __construct() {
    $this->middleware('auth')->only('edit', 'update');
}

Which methods will have the 'auth' middleware applied?

medium

A. Only the edit and update methods

B. All methods except edit and update

C. All methods in the controller

D. No methods, syntax error

Solution

1. Step 1: Understand the use of only() method

   The only('edit', 'update') limits middleware to run only on these two methods.

2. Step 2: Confirm middleware application

   Middleware 'auth' applies only to 'edit' and 'update', other methods are unaffected.

3. Final Answer:

   Only the edit and update methods -> Option A

4. Quick Check:

   only() limits middleware to specified methods = D [OK]

Hint: only() applies middleware to listed methods only [OK]

Common Mistakes:

• Confusing only() with except()
• Assuming middleware applies to all methods
• Thinking syntax causes error

4. Identify the error in this controller constructor:

public function __construct() {
    $this->middleware('auth')->except('index', 'show');
    $this->middleware('log');
}

medium

A. Middleware 'log' will override 'auth' middleware

B. You cannot call middleware twice in constructor

C. except() method requires array, not multiple arguments

D. No error; both middleware apply correctly

Solution

1. Step 1: Check multiple middleware calls

   Laravel allows multiple middleware calls in constructor; they stack and apply in order.

2. Step 2: Validate except() usage

   except() accepts multiple string arguments or an array; both are valid.

3. Final Answer:

   No error; both middleware apply correctly -> Option D

4. Quick Check:

   Multiple middleware calls and except() usage are valid = C [OK]

Hint: Multiple middleware calls stack; except() accepts multiple args [OK]

Common Mistakes:

• Thinking multiple middleware calls override each other
• Assuming except() needs array only
• Believing syntax causes error

5. You want to apply the 'verified' middleware to all controller methods except 'index' and 'show', and also apply 'log' middleware only to 'store' and 'update'. Which constructor code correctly implements this using arrays?

hard

A. public function __construct() {
$this->middleware('verified')->only('index', 'show');
$this->middleware('log')->except('store', 'update');
}

B. public function __construct() {
$this->middleware('verified')->except(['index', 'show']);
$this->middleware('log')->only(['store', 'update']);
}

C. public function __construct() {
$this->middleware('verified');
$this->middleware('log');
}

D. public function __construct() {
$this->middleware('verified')->except('index', 'show');
$this->middleware('log')->only('store', 'update');
}

Solution

1. Step 1: Apply 'verified' middleware except on 'index' and 'show'

   Use except() with array to exclude 'index' and 'show' from 'verified' middleware.

2. Step 2: Apply 'log' middleware only on 'store' and 'update'

   Use only() with array to limit 'log' middleware to 'store' and 'update' methods.

3. Step 3: Compare options

   public function __construct() { $this->middleware('verified')->except('index', 'show'); $this->middleware('log')->only('store', 'update'); } uses except() and only() with multiple string arguments (valid but less common). public function __construct() { $this->middleware('verified')->except(['index', 'show']); $this->middleware('log')->only(['store', 'update']); } uses arrays which is clearer and recommended. Options B and C do not match requirements.

4. Final Answer:

   public function __construct() { $this->middleware('verified')->except(['index', 'show']); $this->middleware('log')->only(['store', 'update']); } -> Option B

5. Quick Check:

   Use except() and only() with arrays for clarity = A [OK]

Hint: Use except() and only() with arrays for multiple methods [OK]

Common Mistakes:

• Mixing only() and except() incorrectly
• Not using arrays for multiple methods
• Applying middleware to wrong methods