Route middleware in Laravel - Step-by-Step Execution

Concept Flow - Route middleware

Request comes in

↓

Route matched

↓

Middleware stack starts

↓

Middleware 1: Check condition

Yes No↓

Pass

↓

Middleware 2: Next check

↓

Controller or final handler

↓

Response sent back

When a request matches a route, Laravel runs middleware in order. Each middleware can allow the request to continue or stop it with a response.

Execution Sample

Laravel

Route::middleware(['auth', 'verified'])->get('/dashboard', function () {
    return 'Welcome!';
});

This route uses 'auth' and 'verified' middleware before showing the dashboard.

Execution Table

Step	Middleware	Condition Checked	Result	Action Taken	Next Step
1	auth	Is user logged in?	Yes	Pass request to next middleware	Go to Step 2
2	verified	Is user email verified?	Yes	Pass request to controller	Go to Step 3
3	controller	N/A	N/A	Return 'Welcome!'	Send response
Exit	N/A	N/A	N/A	Response sent back to client	End

💡 Middleware passed all checks; controller returned response; response sent to client.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3
request_status	Incoming request	Authenticated	Verified	Handled by controller
response	None	None	None	'Welcome!' string

Key Moments - 3 Insights

What happens if the 'auth' middleware fails?

If 'auth' fails (user not logged in), it stops the request and returns a redirect or error immediately, so later middleware and controller do not run. See Step 1 in execution_table.

Can middleware modify the request before passing it on?

Yes, middleware can change the request or add data before passing it to the next middleware or controller. This happens between steps in the middleware stack.

Why is middleware order important?

Middleware run in the order listed. If an early middleware blocks the request, later ones never run. So order controls which checks happen first.

Visual Quiz - 3 Questions

Look at the execution_table, what is the result of the 'auth' middleware at Step 1?

A User is authenticated, request passes on

B User is not authenticated, request blocked

C User email is verified

D Controller returns response

💡 Hint

Check the 'Result' column for Step 1 in execution_table

At which step does the controller handle the request?

A Step 1

B Step 2

C Step 3

D Exit

💡 Hint

Look for 'controller' in the Middleware column in execution_table

If the 'verified' middleware fails, what happens next?

A Request continues to controller

B Request is blocked and response sent immediately

C Next middleware runs

D Request is retried

💡 Hint

See the branching logic in concept_flow and Step 2 in execution_table

Concept Snapshot

Route middleware runs before the controller.
Each middleware checks conditions.
If a middleware fails, it stops the request.
Middleware run in the order listed.
If all pass, controller handles the request.
Response then returns to client.

Full Transcript

When a web request comes to Laravel, it first finds the matching route. Before running the route's controller, Laravel runs middleware in the order they are listed. Each middleware checks something, like if the user is logged in or email verified. If a middleware check fails, it stops the request and sends a response, like a redirect or error. If it passes, the request moves to the next middleware. After all middleware pass, the controller runs and returns a response. This response then goes back to the user. Middleware order matters because the first failure stops everything else.

Practice

1. What is the main purpose of route middleware in Laravel?

easy

A. To run code before or after a route handles a request

B. To define database relationships

C. To create views for the application

D. To manage session storage

Solution

1. Step 1: Understand middleware role

   Middleware runs code before or after a route processes a request to add extra logic.

2. Step 2: Compare with other options

   Database relationships, views, and session storage are unrelated to middleware's main role.

3. Final Answer:

   To run code before or after a route handles a request -> Option A

4. Quick Check:

   Middleware = Pre/Post route code [OK]

Hint: Middleware runs code around route handling [OK]

Common Mistakes:

• Confusing middleware with database or view logic
• Thinking middleware manages sessions directly
• Assuming middleware creates HTML views

2. Which of the following is the correct way to apply middleware named auth to a route in Laravel?

easy

A. Route::get('/dashboard', function () {})->middleware('auth');

B. Route::get('/dashboard', function () {}, 'auth');

C. Route::get('/dashboard', function () {})->useMiddleware('auth');

D. Route::get('/dashboard', function () {})->apply('auth');

Solution

1. Step 1: Recall middleware syntax for routes

   Laravel uses ->middleware('name') to assign middleware to a route.

2. Step 2: Check syntax

   Only Route::get('/dashboard', function () {})->middleware('auth'); uses the correct method. Others use non-existent methods like apply() and useMiddleware() or pass invalid extra arguments.

3. Final Answer:

   Route::get('/dashboard', function () {})->middleware('auth'); -> Option A

4. Quick Check:

   Correct middleware method = middleware() [OK]

Hint: Use ->middleware('name') after route definition [OK]

Common Mistakes:

• Using non-existent methods like useMiddleware or apply
• Placing middleware before route method incorrectly
• Forgetting to pass middleware name as string

3. Given the route group below, what middleware will be applied to the /profile route?

Route::middleware(['auth', 'verified'])->group(function () {
    Route::get('/profile', function () {
        return 'User Profile';
    });
});

medium

A. No middleware applied

B. Only 'verified' middleware

C. Only 'auth' middleware

D. Both 'auth' and 'verified' middleware

Solution

1. Step 1: Understand middleware groups

   Middleware array passed to middleware() applies all listed middleware to routes inside the group.

2. Step 2: Check the group middleware list

   The group uses ['auth', 'verified'], so both middleware run on /profile route.

3. Final Answer:

   Both 'auth' and 'verified' middleware -> Option D

4. Quick Check:

   Group middleware = all listed middleware [OK]

Hint: Middleware array applies all listed middleware [OK]

Common Mistakes:

• Assuming only first middleware applies
• Thinking middleware arrays override each other
• Ignoring middleware groups and only checking route

4. Identify the error in this middleware assignment:

Route::get('/settings', function () {
    return 'Settings';
})->middleware(auth);

medium

A. Middleware cannot be applied to GET routes

B. Middleware must be registered in the controller

C. Middleware name should be a string

D. Middleware should be applied using ->useMiddleware()

Solution

1. Step 1: Check middleware argument type

   Middleware names must be passed as strings, e.g., 'auth', not bare words.

2. Step 2: Verify other options

   Middleware can be applied to GET routes; no need for controller registration here; useMiddleware() is invalid.

3. Final Answer:

   Middleware name should be a string -> Option C

4. Quick Check:

   Middleware name = string in quotes [OK]

Hint: Always quote middleware names as strings [OK]

Common Mistakes:

• Passing middleware name without quotes
• Thinking middleware only works on POST routes
• Using non-existent middleware methods

5. You want to apply a middleware named checkAge only to routes under /admin but exclude it from /admin/login. Which is the best way to do this in Laravel?

hard

A. Apply checkAge middleware globally and remove it from /admin/login

B. Apply checkAge middleware to the group /admin and add except for /admin/login

C. Apply checkAge middleware only to /admin/login route

D. Apply checkAge middleware to all routes except /admin

Solution

1. Step 1: Understand middleware group usage

   Applying middleware to a route group covers all routes inside it.

2. Step 2: Use 'except' to exclude specific routes

   Laravel allows excluding routes from middleware using 'except' in middleware definition or group.

3. Step 3: Evaluate options

   Apply checkAge middleware to the group /admin and add except for /admin/login correctly applies middleware to /admin group and excludes /admin/login. Others apply middleware incorrectly or globally.

4. Final Answer:

   Apply checkAge middleware to the group /admin and add except for /admin/login -> Option B

5. Quick Check:

   Group middleware + except route = correct approach [OK]

Hint: Use middleware group with except to exclude routes [OK]

Common Mistakes:

• Applying middleware only to excluded route
• Applying middleware globally without exclusions
• Excluding entire /admin instead of just /admin/login