Why Route middleware in Laravel? - Purpose & Use Cases

The Big Idea

Discover how a simple gatekeeper can protect your app effortlessly!

The Scenario

Imagine you have a website where some pages should only be seen by logged-in users, and others by everyone. You try to check user access on every page manually by adding code in each controller or route.

The Problem

Manually checking access everywhere is tiring and easy to forget. It leads to repeated code, mistakes, and security holes if you miss a check. It also makes your code messy and hard to update.

The Solution

Route middleware lets you write access checks once and apply them easily to any route. It acts like a gatekeeper that runs before the page loads, keeping your code clean and secure.

Before vs After

✗ Before

if (!auth()->check()) { return redirect('/login'); } // repeated in every route

✓ After

Route::middleware('auth')->group(function () { Route::get('/dashboard', function () { /* ... */ }); });

What It Enables

It enables simple, reusable control over who can see what, improving security and code clarity.

Real Life Example

On an online store, only logged-in users can access their order history page. Middleware ensures this without repeating login checks everywhere.

Key Takeaways

Manual access checks are repetitive and error-prone.

Middleware centralizes and automates route access control.

This keeps your app secure and your code clean.

Practice

1. What is the main purpose of route middleware in Laravel?

easy

A. To run code before or after a route handles a request

B. To define database relationships

C. To create views for the application

D. To manage session storage

Solution

1. Step 1: Understand middleware role

   Middleware runs code before or after a route processes a request to add extra logic.

2. Step 2: Compare with other options

   Database relationships, views, and session storage are unrelated to middleware's main role.

3. Final Answer:

   To run code before or after a route handles a request -> Option A

4. Quick Check:

   Middleware = Pre/Post route code [OK]

Hint: Middleware runs code around route handling [OK]

Common Mistakes:

• Confusing middleware with database or view logic
• Thinking middleware manages sessions directly
• Assuming middleware creates HTML views

2. Which of the following is the correct way to apply middleware named auth to a route in Laravel?

easy

A. Route::get('/dashboard', function () {})->middleware('auth');

B. Route::get('/dashboard', function () {}, 'auth');

C. Route::get('/dashboard', function () {})->useMiddleware('auth');

D. Route::get('/dashboard', function () {})->apply('auth');

Solution

1. Step 1: Recall middleware syntax for routes

   Laravel uses ->middleware('name') to assign middleware to a route.

2. Step 2: Check syntax

   Only Route::get('/dashboard', function () {})->middleware('auth'); uses the correct method. Others use non-existent methods like apply() and useMiddleware() or pass invalid extra arguments.

3. Final Answer:

   Route::get('/dashboard', function () {})->middleware('auth'); -> Option A

4. Quick Check:

   Correct middleware method = middleware() [OK]

Hint: Use ->middleware('name') after route definition [OK]

Common Mistakes:

• Using non-existent methods like useMiddleware or apply
• Placing middleware before route method incorrectly
• Forgetting to pass middleware name as string

3. Given the route group below, what middleware will be applied to the /profile route?

Route::middleware(['auth', 'verified'])->group(function () {
    Route::get('/profile', function () {
        return 'User Profile';
    });
});

medium

A. No middleware applied

B. Only 'verified' middleware

C. Only 'auth' middleware

D. Both 'auth' and 'verified' middleware

Solution

1. Step 1: Understand middleware groups

   Middleware array passed to middleware() applies all listed middleware to routes inside the group.

2. Step 2: Check the group middleware list

   The group uses ['auth', 'verified'], so both middleware run on /profile route.

3. Final Answer:

   Both 'auth' and 'verified' middleware -> Option D

4. Quick Check:

   Group middleware = all listed middleware [OK]

Hint: Middleware array applies all listed middleware [OK]

Common Mistakes:

• Assuming only first middleware applies
• Thinking middleware arrays override each other
• Ignoring middleware groups and only checking route

4. Identify the error in this middleware assignment:

Route::get('/settings', function () {
    return 'Settings';
})->middleware(auth);

medium

A. Middleware cannot be applied to GET routes

B. Middleware must be registered in the controller

C. Middleware name should be a string

D. Middleware should be applied using ->useMiddleware()

Solution

1. Step 1: Check middleware argument type

   Middleware names must be passed as strings, e.g., 'auth', not bare words.

2. Step 2: Verify other options

   Middleware can be applied to GET routes; no need for controller registration here; useMiddleware() is invalid.

3. Final Answer:

   Middleware name should be a string -> Option C

4. Quick Check:

   Middleware name = string in quotes [OK]

Hint: Always quote middleware names as strings [OK]

Common Mistakes:

• Passing middleware name without quotes
• Thinking middleware only works on POST routes
• Using non-existent middleware methods

5. You want to apply a middleware named checkAge only to routes under /admin but exclude it from /admin/login. Which is the best way to do this in Laravel?

hard

A. Apply checkAge middleware globally and remove it from /admin/login

B. Apply checkAge middleware to the group /admin and add except for /admin/login

C. Apply checkAge middleware only to /admin/login route

D. Apply checkAge middleware to all routes except /admin

Solution

1. Step 1: Understand middleware group usage

   Applying middleware to a route group covers all routes inside it.

2. Step 2: Use 'except' to exclude specific routes

   Laravel allows excluding routes from middleware using 'except' in middleware definition or group.

3. Step 3: Evaluate options

   Apply checkAge middleware to the group /admin and add except for /admin/login correctly applies middleware to /admin group and excludes /admin/login. Others apply middleware incorrectly or globally.

4. Final Answer:

   Apply checkAge middleware to the group /admin and add except for /admin/login -> Option B

5. Quick Check:

   Group middleware + except route = correct approach [OK]

Hint: Use middleware group with except to exclude routes [OK]

Common Mistakes:

• Applying middleware only to excluded route
• Applying middleware globally without exclusions
• Excluding entire /admin instead of just /admin/login