Why middleware filters requests in Laravel - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a middleware that checks if a user is authenticated.

Laravel

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;

class Authenticate
{
    public function handle(Request $request, Closure $next)
    {
        if (!auth()->check()) {
            return redirect()->route('[1]');
        }
        return $next($request);
    }
}

Drag options to blanks, or click blank then click option'

Adashboard

Bhome

Clogin

Dregister

Attempts:

3 left

💡 Hint

Common Mistakes

Redirecting to 'home' or 'dashboard' instead of 'login'.

Using a URL instead of a route name.

The middleware redirects unauthenticated users to the login route.

2fill in blank

medium

Complete the middleware code to allow only users with 'admin' role to proceed.

Laravel

<?php

public function handle(Request $request, Closure $next)
{
    if ($request->user()->role !== '[1]') {
        abort(403);
    }
    return $next($request);
}

Drag options to blanks, or click blank then click option'

Auser

Badmin

Cguest

Deditor

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'user' or 'guest' instead of 'admin'.

Not aborting with 403 status code.

The middleware checks if the user's role is 'admin' to allow access.

3fill in blank

hard

Fix the error in the middleware that should check if the request method is POST.

Laravel

<?php

public function handle(Request $request, Closure $next)
{
    if ($request->method() !== '[1]') {
        return redirect()->back();
    }
    return $next($request);
}

Drag options to blanks, or click blank then click option'

APOST

BGET

CPUT

DDELETE

Attempts:

3 left

💡 Hint

Common Mistakes

Checking for 'GET' instead of 'POST'.

Using uppercase or lowercase inconsistently.

The middleware should allow only POST requests to proceed.

4fill in blank

hard

Fill both blanks to create a middleware that filters requests with a specific header and aborts if missing.

Laravel

<?php

public function handle(Request $request, Closure $next)
{
    if (!$request->headers->has('[1]')) {
        abort([2]);
    }
    return $next($request);
}

Drag options to blanks, or click blank then click option'

AX-Auth-Token

BAuthorization

C404

D403

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Authorization' header instead of 'X-Auth-Token'.

Aborting with 404 instead of 403.

The middleware checks for the 'X-Auth-Token' header and aborts with 403 if missing.

5fill in blank

hard

Fill all three blanks to create a middleware that filters requests by IP and method, aborting if conditions fail.

Laravel

<?php

public function handle(Request $request, Closure $next)
{
    if ($request->ip() !== '[1]' || $request->method() !== '[2]') {
        abort([3]);
    }
    return $next($request);
}

Drag options to blanks, or click blank then click option'

A192.168.1.1

BPOST

C403

DGET

Attempts:

3 left

💡 Hint

Common Mistakes

Using GET instead of POST for method check.

Using wrong IP address or abort code.

The middleware allows only requests from IP '192.168.1.1' using POST method, aborting with 403 otherwise.

Practice

1. What is the main purpose of middleware in a Laravel application?

easy

A. To filter and check requests before they reach the app

B. To store data permanently in the database

C. To create user interface components

D. To compile CSS and JavaScript files

Solution

1. Step 1: Understand middleware role

   Middleware acts as a gatekeeper that processes requests before they reach the main app logic.

2. Step 2: Identify main purpose

   Its main job is to filter, check, or modify requests to protect or control access.

3. Final Answer:

   To filter and check requests before they reach the app -> Option A

4. Quick Check:

   Middleware filters requests = D [OK]

Hint: Middleware acts before app logic to filter requests [OK]

Common Mistakes:

• Confusing middleware with database storage
• Thinking middleware builds UI components
• Assuming middleware compiles assets

2. Which of the following is the correct way to apply middleware to a route in Laravel?

easy

A. $router->get('/home')->middleware('auth');

B. Route::get('/home')->middleware('auth');

C. Route::get('/home')->useMiddleware('auth');

D. $router->get('/home')->use('auth');

Solution

1. Step 1: Recall Laravel route syntax

   Laravel uses the Route facade with methods like get() and middleware() to assign middleware.

2. Step 2: Identify correct chaining method

   The correct method to apply middleware is middleware(), not useMiddleware() or use().

3. Final Answer:

   Route::get('/home')->middleware('auth'); -> Option B

4. Quick Check:

   Correct middleware method = C [OK]

Hint: Use Route::get()->middleware('name') to apply middleware [OK]

Common Mistakes:

• Using $router instead of Route facade
• Using useMiddleware() instead of middleware()
• Using use() which is not a Laravel method

3. Given this middleware that blocks requests without a 'token' header, what will happen if a request lacks the token?

public function handle($request, Closure $next) {
    if (!$request->hasHeader('token')) {
        return response('Unauthorized', 401);
    }
    return $next($request);
}

medium

A. The request is stopped with a 401 Unauthorized response

B. The request is redirected to the login page

C. The request proceeds normally to the app

D. The request causes a server error

Solution

1. Step 1: Analyze middleware condition

   The middleware checks if the request has a 'token' header; if not, it returns a 401 response immediately.

2. Step 2: Understand request flow

   Without the token header, the middleware stops the request and sends back 'Unauthorized' with status 401.

3. Final Answer:

   The request is stopped with a 401 Unauthorized response -> Option A

4. Quick Check:

   Missing token header = 401 response [OK]

Hint: Middleware returns 401 if token header missing [OK]

Common Mistakes:

• Assuming request proceeds without token
• Thinking it redirects instead of returning 401
• Expecting a server error instead of controlled response

4. This middleware is intended to block requests without 'X-API-KEY' header. What is wrong with it?

public function handle($request, Closure $next) {
    if ($request->header('X-API-KEY') == null) {
        $next($request);
    }
    return response('Forbidden', 403);
}

medium

A. It never calls $next() for valid requests

B. It should return 401 instead of 403

C. It uses wrong header name case

D. It returns 403 even when the header exists

Solution

1. Step 1: Trace middleware logic

   If header is null, it calls $next($request) but does not return it, so execution continues.

2. Step 2: Identify flow error

   After calling $next(), it always returns 403 response, so even valid requests get blocked.

3. Final Answer:

   It returns 403 even when the header exists -> Option D

4. Quick Check:

   Missing return before $next causes wrong 403 always [OK]

Hint: Always return $next($request) to continue request [OK]

Common Mistakes:

• Not returning $next() call
• Misunderstanding header case sensitivity (Laravel handles case)
• Confusing 401 and 403 status codes

5. You want to create middleware that only allows requests with a 'role' header set to 'admin' or 'editor'. Which code snippet correctly implements this filter?

hard

A. public function handle($request, Closure $next) {
if ($request->header('role') === 'admin' && $request->header('role') === 'editor') {
return $next($request);
}
return response('Forbidden', 403);
}

B. public function handle($request, Closure $next) {
if ($request->header('role') == 'admin' || 'editor') {
return $next($request);
}
return response('Forbidden', 403);
}

C. public function handle($request, Closure $next) {
if (in_array($request->header('role'), ['admin', 'editor'])) {
return $next($request);
}
return response('Forbidden', 403);
}

D. public function handle($request, Closure $next) {
if ($request->header('role') != 'admin' || $request->header('role') != 'editor') {
return response('Forbidden', 403);
}
return $next($request);
}

Solution

1. Step 1: Understand role check logic

   The middleware should allow requests if the 'role' header is either 'admin' or 'editor'.

2. Step 2: Evaluate each option's condition

   public function handle($request, Closure $next) { if (in_array($request->header('role'), ['admin', 'editor'])) { return $next($request); } return response('Forbidden', 403); } uses in_array() correctly to check if role is in allowed list. public function handle($request, Closure $next) { if ($request->header('role') == 'admin' || 'editor') { return $next($request); } return response('Forbidden', 403); } has incorrect condition syntax. public function handle($request, Closure $next) { if ($request->header('role') === 'admin' && $request->header('role') === 'editor') { return $next($request); } return response('Forbidden', 403); } requires role to be both 'admin' and 'editor' simultaneously, which is impossible. public function handle($request, Closure $next) { if ($request->header('role') != 'admin' || $request->header('role') != 'editor') { return response('Forbidden', 403); } return $next($request); } logic is inverted and will block valid roles.

3. Final Answer:

   Uses in_array() to correctly filter 'admin' or 'editor' roles -> Option C

4. Quick Check:

   Use in_array() for multiple allowed values [OK]

Hint: Use in_array() to check multiple allowed roles [OK]

Common Mistakes:

• Using || incorrectly without full comparisons
• Checking for both roles with && instead of ||
• Inverting logic causing wrong blocking