Route middleware in Laravel

Introduction

Route middleware helps you run code before or after a web request. It controls access or changes requests easily.

To check if a user is logged in before showing a page.

To log details about each request for debugging.

To block users from certain pages based on roles.

To add security headers to responses.

To redirect users if they don't meet conditions.

Syntax

Laravel

Route::middleware('middlewareName')->group(function () {
    Route::get('/path', [Controller::class, 'method']);
});

Middleware names are registered in app/Http/Kernel.php.

You can apply middleware to single routes or groups of routes.

Examples

This route uses the 'auth' middleware to allow only logged-in users.

Laravel

Route::middleware('auth')->get('/dashboard', function () {
    return 'Welcome to your dashboard';
});

This group of routes requires users to be logged in and email verified.

Laravel

Route::middleware(['auth', 'verified'])->group(function () {
    Route::get('/profile', [ProfileController::class, 'show']);
    Route::post('/profile', [ProfileController::class, 'update']);
});

This route has no middleware, so it is open to all visitors.

Laravel

Route::get('/public', function () {
    return 'Anyone can see this';
});

Sample Program

This example shows two routes. The '/home' route uses a middleware called 'checkAge' to allow access only if the user meets age requirements. The '/open' route is open to all visitors without restrictions.

Laravel

<?php

use Illuminate\Support\Facades\Route;
use App\Http\Controllers\HomeController;

// Define a middleware named 'checkAge' in Kernel.php (assumed)

Route::middleware('checkAge')->get('/home', function () {
    return 'Welcome, you are old enough!';
});

Route::get('/open', function () {
    return 'This page is open to everyone.';
});

Important Notes

Middleware can stop a request and send a response before reaching the route.

You can create custom middleware with php artisan make:middleware MiddlewareName.

Always register your middleware in app/Http/Kernel.php to use it by name.

Summary

Route middleware runs code before or after a route handles a request.

Use middleware to protect routes or modify requests and responses.

Apply middleware to single routes or groups for easy control.

Practice

1. What is the main purpose of route middleware in Laravel?

easy

A. To run code before or after a route handles a request

B. To define database relationships

C. To create views for the application

D. To manage session storage

Solution

1. Step 1: Understand middleware role

   Middleware runs code before or after a route processes a request to add extra logic.

2. Step 2: Compare with other options

   Database relationships, views, and session storage are unrelated to middleware's main role.

3. Final Answer:

   To run code before or after a route handles a request -> Option A

4. Quick Check:

   Middleware = Pre/Post route code [OK]

Hint: Middleware runs code around route handling [OK]

Common Mistakes:

• Confusing middleware with database or view logic
• Thinking middleware manages sessions directly
• Assuming middleware creates HTML views

2. Which of the following is the correct way to apply middleware named auth to a route in Laravel?

easy

A. Route::get('/dashboard', function () {})->middleware('auth');

B. Route::get('/dashboard', function () {}, 'auth');

C. Route::get('/dashboard', function () {})->useMiddleware('auth');

D. Route::get('/dashboard', function () {})->apply('auth');

Solution

1. Step 1: Recall middleware syntax for routes

   Laravel uses ->middleware('name') to assign middleware to a route.

2. Step 2: Check syntax

   Only Route::get('/dashboard', function () {})->middleware('auth'); uses the correct method. Others use non-existent methods like apply() and useMiddleware() or pass invalid extra arguments.

3. Final Answer:

   Route::get('/dashboard', function () {})->middleware('auth'); -> Option A

4. Quick Check:

   Correct middleware method = middleware() [OK]

Hint: Use ->middleware('name') after route definition [OK]

Common Mistakes:

• Using non-existent methods like useMiddleware or apply
• Placing middleware before route method incorrectly
• Forgetting to pass middleware name as string

3. Given the route group below, what middleware will be applied to the /profile route?

Route::middleware(['auth', 'verified'])->group(function () {
    Route::get('/profile', function () {
        return 'User Profile';
    });
});

medium

A. No middleware applied

B. Only 'verified' middleware

C. Only 'auth' middleware

D. Both 'auth' and 'verified' middleware

Solution

1. Step 1: Understand middleware groups

   Middleware array passed to middleware() applies all listed middleware to routes inside the group.

2. Step 2: Check the group middleware list

   The group uses ['auth', 'verified'], so both middleware run on /profile route.

3. Final Answer:

   Both 'auth' and 'verified' middleware -> Option D

4. Quick Check:

   Group middleware = all listed middleware [OK]

Hint: Middleware array applies all listed middleware [OK]

Common Mistakes:

• Assuming only first middleware applies
• Thinking middleware arrays override each other
• Ignoring middleware groups and only checking route

4. Identify the error in this middleware assignment:

Route::get('/settings', function () {
    return 'Settings';
})->middleware(auth);

medium

A. Middleware cannot be applied to GET routes

B. Middleware must be registered in the controller

C. Middleware name should be a string

D. Middleware should be applied using ->useMiddleware()

Solution

1. Step 1: Check middleware argument type

   Middleware names must be passed as strings, e.g., 'auth', not bare words.

2. Step 2: Verify other options

   Middleware can be applied to GET routes; no need for controller registration here; useMiddleware() is invalid.

3. Final Answer:

   Middleware name should be a string -> Option C

4. Quick Check:

   Middleware name = string in quotes [OK]

Hint: Always quote middleware names as strings [OK]

Common Mistakes:

• Passing middleware name without quotes
• Thinking middleware only works on POST routes
• Using non-existent middleware methods

5. You want to apply a middleware named checkAge only to routes under /admin but exclude it from /admin/login. Which is the best way to do this in Laravel?

hard

A. Apply checkAge middleware globally and remove it from /admin/login

B. Apply checkAge middleware to the group /admin and add except for /admin/login

C. Apply checkAge middleware only to /admin/login route

D. Apply checkAge middleware to all routes except /admin

Solution

1. Step 1: Understand middleware group usage

   Applying middleware to a route group covers all routes inside it.

2. Step 2: Use 'except' to exclude specific routes

   Laravel allows excluding routes from middleware using 'except' in middleware definition or group.

3. Step 3: Evaluate options

   Apply checkAge middleware to the group /admin and add except for /admin/login correctly applies middleware to /admin group and excludes /admin/login. Others apply middleware incorrectly or globally.

4. Final Answer:

   Apply checkAge middleware to the group /admin and add except for /admin/login -> Option B

5. Quick Check:

   Group middleware + except route = correct approach [OK]

Hint: Use middleware group with except to exclude routes [OK]

Common Mistakes:

• Applying middleware only to excluded route
• Applying middleware globally without exclusions
• Excluding entire /admin instead of just /admin/login