Why middleware filters requests in Laravel - See It in Action

Why Middleware Filters Requests in Laravel

📖 Scenario: You are building a simple Laravel web application that needs to control access to certain pages. You want to use middleware to filter requests and allow only authenticated users to access a protected page.

🎯 Goal: Learn how to create and apply middleware in Laravel to filter HTTP requests based on authentication status.

📋 What You'll Learn

Create a middleware class named CheckAuthenticated

Define a route /dashboard that uses the middleware

Use a boolean variable $isAuthenticated to simulate user login status

In the middleware, check $isAuthenticated and allow or block access

Return a simple response indicating access granted or denied

💡 Why This Matters

🌍 Real World

Middleware is used in real Laravel apps to protect pages, check user permissions, and handle tasks like logging or modifying requests.

💼 Career

Understanding middleware is essential for backend developers working with Laravel to build secure and well-structured web applications.

1

DATA SETUP: Create a boolean variable $isAuthenticated

Create a boolean variable called $isAuthenticated and set it to false to simulate a user who is not logged in.

Laravel

<?php

// Create a boolean variable $isAuthenticated and set it to false
// Your code here

Hint

Use $isAuthenticated = false; to represent a user who is not logged in.

2

CONFIGURATION: Define a middleware class CheckAuthenticated

Create a middleware class named CheckAuthenticated with a method handle that accepts $request and $next parameters.

Laravel

<?php

$isAuthenticated = false;

// Define class CheckAuthenticated with handle method
// Your code here

Hint

Use a class with a handle method that checks $isAuthenticated and returns a message or calls $next($request).

3

CORE LOGIC: Define a route /dashboard using the middleware

Create a function dashboard that returns 'Welcome to your dashboard!'. Then simulate a request to /dashboard by calling the middleware's handle method with a dummy $request and a closure that calls dashboard.

Laravel

<?php

$isAuthenticated = false;

class CheckAuthenticated
{
    public function handle($request, $next)
    {
        global $isAuthenticated;
        if (!$isAuthenticated) {
            return 'Access denied: Please login first.';
        }
        return $next($request);
    }
}

// Define dashboard function and simulate request with middleware
// Your code here

Hint

Define a dashboard function and call the middleware's handle method with a closure that calls dashboard.

4

COMPLETION: Change $isAuthenticated to true to allow access

Change the value of $isAuthenticated to true so the middleware allows access to the dashboard.

Laravel

handle('/dashboard', function ($request) {
    return dashboard();
});

Hint

Set $isAuthenticated = true; to simulate a logged-in user.

Practice

1. What is the main purpose of middleware in a Laravel application?

easy

A. To filter and check requests before they reach the app

B. To store data permanently in the database

C. To create user interface components

D. To compile CSS and JavaScript files

Solution

1. Step 1: Understand middleware role

   Middleware acts as a gatekeeper that processes requests before they reach the main app logic.

2. Step 2: Identify main purpose

   Its main job is to filter, check, or modify requests to protect or control access.

3. Final Answer:

   To filter and check requests before they reach the app -> Option A

4. Quick Check:

   Middleware filters requests = D [OK]

Hint: Middleware acts before app logic to filter requests [OK]

Common Mistakes:

• Confusing middleware with database storage
• Thinking middleware builds UI components
• Assuming middleware compiles assets

2. Which of the following is the correct way to apply middleware to a route in Laravel?

easy

A. $router->get('/home')->middleware('auth');

B. Route::get('/home')->middleware('auth');

C. Route::get('/home')->useMiddleware('auth');

D. $router->get('/home')->use('auth');

Solution

1. Step 1: Recall Laravel route syntax

   Laravel uses the Route facade with methods like get() and middleware() to assign middleware.

2. Step 2: Identify correct chaining method

   The correct method to apply middleware is middleware(), not useMiddleware() or use().

3. Final Answer:

   Route::get('/home')->middleware('auth'); -> Option B

4. Quick Check:

   Correct middleware method = C [OK]

Hint: Use Route::get()->middleware('name') to apply middleware [OK]

Common Mistakes:

• Using $router instead of Route facade
• Using useMiddleware() instead of middleware()
• Using use() which is not a Laravel method

3. Given this middleware that blocks requests without a 'token' header, what will happen if a request lacks the token?

public function handle($request, Closure $next) {
    if (!$request->hasHeader('token')) {
        return response('Unauthorized', 401);
    }
    return $next($request);
}

medium

A. The request is stopped with a 401 Unauthorized response

B. The request is redirected to the login page

C. The request proceeds normally to the app

D. The request causes a server error

Solution

1. Step 1: Analyze middleware condition

   The middleware checks if the request has a 'token' header; if not, it returns a 401 response immediately.

2. Step 2: Understand request flow

   Without the token header, the middleware stops the request and sends back 'Unauthorized' with status 401.

3. Final Answer:

   The request is stopped with a 401 Unauthorized response -> Option A

4. Quick Check:

   Missing token header = 401 response [OK]

Hint: Middleware returns 401 if token header missing [OK]

Common Mistakes:

• Assuming request proceeds without token
• Thinking it redirects instead of returning 401
• Expecting a server error instead of controlled response

4. This middleware is intended to block requests without 'X-API-KEY' header. What is wrong with it?

public function handle($request, Closure $next) {
    if ($request->header('X-API-KEY') == null) {
        $next($request);
    }
    return response('Forbidden', 403);
}

medium

A. It never calls $next() for valid requests

B. It should return 401 instead of 403

C. It uses wrong header name case

D. It returns 403 even when the header exists

Solution

1. Step 1: Trace middleware logic

   If header is null, it calls $next($request) but does not return it, so execution continues.

2. Step 2: Identify flow error

   After calling $next(), it always returns 403 response, so even valid requests get blocked.

3. Final Answer:

   It returns 403 even when the header exists -> Option D

4. Quick Check:

   Missing return before $next causes wrong 403 always [OK]

Hint: Always return $next($request) to continue request [OK]

Common Mistakes:

• Not returning $next() call
• Misunderstanding header case sensitivity (Laravel handles case)
• Confusing 401 and 403 status codes

5. You want to create middleware that only allows requests with a 'role' header set to 'admin' or 'editor'. Which code snippet correctly implements this filter?

hard

A. public function handle($request, Closure $next) {
if ($request->header('role') === 'admin' && $request->header('role') === 'editor') {
return $next($request);
}
return response('Forbidden', 403);
}

B. public function handle($request, Closure $next) {
if ($request->header('role') == 'admin' || 'editor') {
return $next($request);
}
return response('Forbidden', 403);
}

C. public function handle($request, Closure $next) {
if (in_array($request->header('role'), ['admin', 'editor'])) {
return $next($request);
}
return response('Forbidden', 403);
}

D. public function handle($request, Closure $next) {
if ($request->header('role') != 'admin' || $request->header('role') != 'editor') {
return response('Forbidden', 403);
}
return $next($request);
}

Solution

1. Step 1: Understand role check logic

   The middleware should allow requests if the 'role' header is either 'admin' or 'editor'.

2. Step 2: Evaluate each option's condition

   public function handle($request, Closure $next) { if (in_array($request->header('role'), ['admin', 'editor'])) { return $next($request); } return response('Forbidden', 403); } uses in_array() correctly to check if role is in allowed list. public function handle($request, Closure $next) { if ($request->header('role') == 'admin' || 'editor') { return $next($request); } return response('Forbidden', 403); } has incorrect condition syntax. public function handle($request, Closure $next) { if ($request->header('role') === 'admin' && $request->header('role') === 'editor') { return $next($request); } return response('Forbidden', 403); } requires role to be both 'admin' and 'editor' simultaneously, which is impossible. public function handle($request, Closure $next) { if ($request->header('role') != 'admin' || $request->header('role') != 'editor') { return response('Forbidden', 403); } return $next($request); } logic is inverted and will block valid roles.

3. Final Answer:

   Uses in_array() to correctly filter 'admin' or 'editor' roles -> Option C

4. Quick Check:

   Use in_array() for multiple allowed values [OK]

Hint: Use in_array() to check multiple allowed roles [OK]

Common Mistakes:

• Using || incorrectly without full comparisons
• Checking for both roles with && instead of ||
• Inverting logic causing wrong blocking