Route middleware in Laravel - Mini Project: Build & Apply

Laravel Route Middleware Setup

📖 Scenario: You are building a Laravel web application that has a special admin section. You want to make sure only authenticated users can access the admin routes.

🎯 Goal: Create a route middleware that checks if a user is authenticated before allowing access to the admin routes.

📋 What You'll Learn

Create a middleware class named CheckAuthenticated

Register the middleware in the HTTP kernel with the key auth.check

Apply the auth.check middleware to the /admin/dashboard route

Ensure the middleware redirects unauthenticated users to the /login page

💡 Why This Matters

🌍 Real World

Middleware is used in Laravel apps to control access and modify requests before they reach your routes or controllers.

💼 Career

Understanding middleware is essential for Laravel developers to implement security, logging, and request filtering in real projects.

1

Create the middleware class

Create a middleware class named CheckAuthenticated inside the app/Http/Middleware directory. The class should have a handle method that accepts $request, Closure $next, and returns $next($request).

Laravel

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;

class CheckAuthenticated
{
    // Your code here
}

Hint

Middleware classes go in app/Http/Middleware. The handle method is required and must return $next($request) to continue the request.

2

Add authentication check in middleware

Inside the handle method of CheckAuthenticated, add a condition to check if the user is not authenticated using auth()->check(). If not authenticated, redirect to /login. Otherwise, continue the request with $next($request).

Laravel

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;

class CheckAuthenticated
{
    public function handle(Request $request, Closure $next)
    {
        // Your code here
    }
}

Hint

Use auth()->check() to verify if the user is logged in. Redirect unauthenticated users to /login.

3

Register the middleware in HTTP kernel

Open app/Http/Kernel.php and add the middleware class \App\Http\Middleware\CheckAuthenticated::class to the $routeMiddleware array with the key 'auth.check'.

Laravel

<?php

protected $routeMiddleware = [
    // Your code here
];

Hint

Register your middleware in the $routeMiddleware array in Kernel.php so you can use it in routes.

4

Apply middleware to admin route

In routes/web.php, create a route for /admin/dashboard that returns the string 'Admin Dashboard'. Apply the middleware 'auth.check' to this route using the middleware method.

Laravel

<?php

use Illuminate\Support\Facades\Route;

// Your code here

Hint

Use Route::get() to define the route and chain ->middleware('auth.check') to apply your middleware.

Practice

1. What is the main purpose of route middleware in Laravel?

easy

A. To run code before or after a route handles a request

B. To define database relationships

C. To create views for the application

D. To manage session storage

Solution

1. Step 1: Understand middleware role

   Middleware runs code before or after a route processes a request to add extra logic.

2. Step 2: Compare with other options

   Database relationships, views, and session storage are unrelated to middleware's main role.

3. Final Answer:

   To run code before or after a route handles a request -> Option A

4. Quick Check:

   Middleware = Pre/Post route code [OK]

Hint: Middleware runs code around route handling [OK]

Common Mistakes:

• Confusing middleware with database or view logic
• Thinking middleware manages sessions directly
• Assuming middleware creates HTML views

2. Which of the following is the correct way to apply middleware named auth to a route in Laravel?

easy

A. Route::get('/dashboard', function () {})->middleware('auth');

B. Route::get('/dashboard', function () {}, 'auth');

C. Route::get('/dashboard', function () {})->useMiddleware('auth');

D. Route::get('/dashboard', function () {})->apply('auth');

Solution

1. Step 1: Recall middleware syntax for routes

   Laravel uses ->middleware('name') to assign middleware to a route.

2. Step 2: Check syntax

   Only Route::get('/dashboard', function () {})->middleware('auth'); uses the correct method. Others use non-existent methods like apply() and useMiddleware() or pass invalid extra arguments.

3. Final Answer:

   Route::get('/dashboard', function () {})->middleware('auth'); -> Option A

4. Quick Check:

   Correct middleware method = middleware() [OK]

Hint: Use ->middleware('name') after route definition [OK]

Common Mistakes:

• Using non-existent methods like useMiddleware or apply
• Placing middleware before route method incorrectly
• Forgetting to pass middleware name as string

3. Given the route group below, what middleware will be applied to the /profile route?

Route::middleware(['auth', 'verified'])->group(function () {
    Route::get('/profile', function () {
        return 'User Profile';
    });
});

medium

A. No middleware applied

B. Only 'verified' middleware

C. Only 'auth' middleware

D. Both 'auth' and 'verified' middleware

Solution

1. Step 1: Understand middleware groups

   Middleware array passed to middleware() applies all listed middleware to routes inside the group.

2. Step 2: Check the group middleware list

   The group uses ['auth', 'verified'], so both middleware run on /profile route.

3. Final Answer:

   Both 'auth' and 'verified' middleware -> Option D

4. Quick Check:

   Group middleware = all listed middleware [OK]

Hint: Middleware array applies all listed middleware [OK]

Common Mistakes:

• Assuming only first middleware applies
• Thinking middleware arrays override each other
• Ignoring middleware groups and only checking route

4. Identify the error in this middleware assignment:

Route::get('/settings', function () {
    return 'Settings';
})->middleware(auth);

medium

A. Middleware cannot be applied to GET routes

B. Middleware must be registered in the controller

C. Middleware name should be a string

D. Middleware should be applied using ->useMiddleware()

Solution

1. Step 1: Check middleware argument type

   Middleware names must be passed as strings, e.g., 'auth', not bare words.

2. Step 2: Verify other options

   Middleware can be applied to GET routes; no need for controller registration here; useMiddleware() is invalid.

3. Final Answer:

   Middleware name should be a string -> Option C

4. Quick Check:

   Middleware name = string in quotes [OK]

Hint: Always quote middleware names as strings [OK]

Common Mistakes:

• Passing middleware name without quotes
• Thinking middleware only works on POST routes
• Using non-existent middleware methods

5. You want to apply a middleware named checkAge only to routes under /admin but exclude it from /admin/login. Which is the best way to do this in Laravel?

hard

A. Apply checkAge middleware globally and remove it from /admin/login

B. Apply checkAge middleware to the group /admin and add except for /admin/login

C. Apply checkAge middleware only to /admin/login route

D. Apply checkAge middleware to all routes except /admin

Solution

1. Step 1: Understand middleware group usage

   Applying middleware to a route group covers all routes inside it.

2. Step 2: Use 'except' to exclude specific routes

   Laravel allows excluding routes from middleware using 'except' in middleware definition or group.

3. Step 3: Evaluate options

   Apply checkAge middleware to the group /admin and add except for /admin/login correctly applies middleware to /admin group and excludes /admin/login. Others apply middleware incorrectly or globally.

4. Final Answer:

   Apply checkAge middleware to the group /admin and add except for /admin/login -> Option B

5. Quick Check:

   Group middleware + except route = correct approach [OK]

Hint: Use middleware group with except to exclude routes [OK]

Common Mistakes:

• Applying middleware only to excluded route
• Applying middleware globally without exclusions
• Excluding entire /admin instead of just /admin/login