Creating middleware in Laravel - Visual Walkthrough

Concept Flow - Creating middleware

Request enters app

↓

Middleware invoked

↓

Middleware checks condition

↓

Allow request

↓

Controller runs

↓

Response returns to client

The request passes through middleware which checks conditions and either allows it to continue or blocks it.

Execution Sample

Laravel

php artisan make:middleware CheckAge

public function handle($request, Closure $next) {
  if ($request->age < 18) {
    return redirect('home');
  }
  return $next($request);
}

This middleware checks if the user's age is less than 18 and redirects if true, otherwise it lets the request continue.

Execution Table

Step	Action	Condition Checked	Result	Next Step
1	Request enters middleware	N/A	Middleware starts	Check age condition
2	Check if age < 18	age = 16	True	Redirect to home
3	Redirect response sent	N/A	Request blocked	End
4	Request ends	N/A	No controller reached	End

💡 Request blocked because age < 18 condition was true, so middleware redirected.

Variable Tracker

Variable	Start	After Step 2	Final
age	unknown	16	16
request_status	incoming	checked	redirected

Key Moments - 2 Insights

Why does the request stop and not reach the controller?

Because at step 2 in the execution_table, the condition age < 18 is true, so middleware returns a redirect response instead of calling $next($request).

What does $next($request) do in middleware?

It passes the request to the next middleware or the controller. Without calling $next, the request stops in middleware.

Visual Quiz - 3 Questions

Look at the execution_table, what happens at step 2 when age is 16?

A The request is allowed to continue to the controller

B The request is redirected to home

C The middleware throws an error

D The request is logged but continues

💡 Hint

Check the 'Result' column in step 2 of execution_table.

At which step does the middleware stop the request from continuing?

A Step 1

B Step 3

C Step 2

D Step 4

💡 Hint

Look for when the redirect response is sent in execution_table.

If age was 20, how would the execution_table change?

A Step 2 condition would be false and request continues

B Step 3 redirect would still happen

C Middleware would throw an error

D Request would be blocked at step 1

💡 Hint

Think about the condition age < 18 in step 2.

Concept Snapshot

Creating middleware in Laravel:
- Use 'php artisan make:middleware Name' to create.
- Middleware handle() checks request conditions.
- Return redirect or response to block.
- Call $next($request) to continue.
- Middleware runs before controller.
- Useful for auth, logging, filters.

Full Transcript

Middleware in Laravel acts like a gatekeeper for requests. When a request comes in, it first passes through middleware. The middleware checks conditions, like if the user's age is less than 18. If the condition is true, the middleware can stop the request and redirect it elsewhere, like to the home page. If the condition is false, the middleware calls $next($request) to let the request continue to the controller. This process helps control access and modify requests before they reach the main app logic.

Practice

1. What is the primary purpose of middleware in Laravel?

easy

A. To define routes for the application

B. To filter and modify HTTP requests before they reach the controller

C. To create database migrations automatically

D. To generate views for the user interface

Solution

1. Step 1: Understand middleware role

   Middleware acts as a filter that processes HTTP requests before they reach the controller or after the response leaves the controller.

2. Step 2: Identify correct purpose

   Among the options, only filtering and modifying HTTP requests matches middleware's role.

3. Final Answer:

   To filter and modify HTTP requests before they reach the controller -> Option B

4. Quick Check:

   Middleware filters requests [OK]

Hint: Middleware filters requests before controllers [OK]

Common Mistakes:

• Confusing middleware with routing
• Thinking middleware creates database migrations
• Assuming middleware generates views

2. Which command correctly creates a new middleware named CheckAge in Laravel?

easy

A. php artisan make:middleware CheckAge

B. php artisan create:middleware CheckAge

C. php artisan middleware:create CheckAge

D. php artisan generate:middleware CheckAge

Solution

1. Step 1: Recall Laravel artisan command for middleware

   The correct command to create middleware is php artisan make:middleware Name.

2. Step 2: Match the command with options

   Only php artisan make:middleware CheckAge uses the exact correct syntax.

3. Final Answer:

   php artisan make:middleware CheckAge -> Option A

4. Quick Check:

   Use 'make:middleware' to create middleware [OK]

Hint: Use 'make:middleware' with artisan to create middleware [OK]

Common Mistakes:

• Using 'create:middleware' instead of 'make:middleware'
• Mixing command order or keywords
• Forgetting to specify middleware name

3. Given this middleware handle method, what will happen if the user is not authenticated?

public function handle($request, Closure $next) {
    if (!auth()->check()) {
        return redirect('login');
    }
    return $next($request);
}

medium

A. The request proceeds to the next middleware or controller

B. The request is blocked with a 403 Forbidden response

C. An error is thrown because of missing return

D. The user is redirected to the login page

Solution

1. Step 1: Analyze the authentication check

   The code checks if the user is not authenticated using !auth()->check().

2. Step 2: Understand the redirect action

   If not authenticated, it returns a redirect response to 'login', stopping further request processing.

3. Final Answer:

   The user is redirected to the login page -> Option D

4. Quick Check:

   Unauthenticated users get redirected [OK]

Hint: Redirect happens if auth check fails [OK]

Common Mistakes:

• Assuming request proceeds despite failed auth
• Thinking an error is thrown
• Confusing redirect with 403 response

4. Identify the error in this middleware handle method:

public function handle($request, Closure $next) {
    if ($request->user()->role !== 'admin') {
        abort(403, 'Unauthorized');
    }
}

medium

A. No error, this middleware is correct

B. Incorrect method name, should be handleRequest

C. Missing return statement for $next middleware call

D. Using abort() is not allowed in middleware

Solution

1. Step 1: Check middleware handle method structure

   Middleware must return either a response or call $next($request) to continue the request.

2. Step 2: Identify missing return

   This code aborts if role is not admin but does not return $next($request) if the user is admin, causing no response to be returned.

3. Final Answer:

   Missing return statement for $next middleware call -> Option C

4. Quick Check:

   Always return $next($request) to continue [OK]

Hint: Always return $next($request) in middleware [OK]

Common Mistakes:

• Forgetting to return $next($request)
• Thinking abort() is disallowed
• Renaming handle method incorrectly

5. You want to create middleware that blocks requests with a query parameter blocked=true by aborting with a 403 Forbidden response. Which handle method implementation correctly achieves this?

hard

A. public function handle($request, Closure $next) {
if ($request->query('blocked') === 'true') {
abort(403, 'Access denied');
}
return $next($request);
}

B. public function handle($request, Closure $next) {
if ($request->input('blocked') == true) {
return redirect('home');
}
return $next($request);
}

C. public function handle($request, Closure $next) {
if ($request->blocked === true) {
abort(404);
}
return $next($request);
}

D. public function handle($request, Closure $next) {
if ($request->has('blocked')) {
return response('Blocked', 401);
}
return $next($request);
}

Solution

1. Step 1: Check how to read query parameters

   Use $request->query('blocked') to get the query parameter value as string.

2. Step 2: Verify condition and response

   public function handle($request, Closure $next) { if ($request->query('blocked') === 'true') { abort(403, 'Access denied'); } return $next($request); } checks if 'blocked' equals string 'true' and aborts with 403, then returns next middleware call.

3. Step 3: Compare other options

   public function handle($request, Closure $next) { if ($request->input('blocked') == true) { return redirect('home'); } return $next($request); } uses input() and redirects instead of aborting; public function handle($request, Closure $next) { if ($request->blocked === true) { abort(404); } return $next($request); } accesses property incorrectly; public function handle($request, Closure $next) { if ($request->has('blocked')) { return response('Blocked', 401); } return $next($request); } returns 401 but blocks any 'blocked' param regardless of value.

4. Final Answer:

   Checks $request->query('blocked') === 'true' and uses abort(403, 'Access denied') -> Option A

5. Quick Check:

   Use $request->query('blocked') and abort(403) [OK]

Hint: Use $request->query('param') and abort(403) to block [OK]

Common Mistakes:

• Using $request->blocked instead of query()
• Returning redirect instead of abort
• Not checking exact 'true' string value