{"id":12326,"date":"2025-12-20T10:15:08","date_gmt":"2025-12-20T04:45:08","guid":{"rendered":"https:\/\/www.youstable.com\/blog\/?p=12326"},"modified":"2026-03-25T10:38:48","modified_gmt":"2026-03-25T05:08:48","slug":"what-is-middleware-in-laravel-how-to-use","status":"publish","type":"post","link":"https:\/\/www.youstable.com\/blog\/what-is-middleware-in-laravel-how-to-use","title":{"rendered":"What is Middleware in Laravel? How to Use (Easy Guide)"},"content":{"rendered":"\n

Middleware in Laravel is<\/strong> a lightweight, pluggable layer that sits between an HTTP request and your application. It inspects, filters, or modifies requests (and responses) before they reach controllers. Use it to enforce authentication, throttle APIs, validate signatures, set locales, handle CORS, or implement business agnostic policies in a clean, reusable way.<\/p>\n\n\n\n

If you\u2019re new to Laravel or modern PHP frameworks, understanding middleware is essential. In simple terms, middleware in Laravel works like a security and policy gate for your routes. It ensures only the right requests reach your controllers, while giving you a structured way to run pre\/post logic across your app.<\/p>\n\n\n\n

\n\n\n\n

What Is Middleware in Laravel?<\/h2>\n\n\n\n

Middleware in Laravel is code that runs during the HTTP request lifecycle. Each middleware can \u201clook\u201d at the incoming<\/a> request, perform checks or mutations, and then decide whether to continue the request pipeline or abort with a response. After the controller responds, middleware can also modify the outgoing response.<\/p>\n\n\n\n

\"What<\/figure>\n\n\n\n

Think of it as an assembly line of checks: authentication, CSRF validation, CORS, maintenance mode, IP allowlists, and more. Laravel ships with helpful defaults, and you can create custom middleware for domain specific needs.<\/p>\n\n\n\n

\n\n\n\n

How Laravel Middleware Works (Request Lifecycle)<\/h2>\n\n\n\n
\"How<\/figure>\n\n\n\n

Laravel processes each request through a pipeline of middleware. Order matters: global middleware wraps all requests; group middleware applies to specific route groups (like web<\/em> and api<\/em>); and route middleware can be applied to individual routes.<\/p>\n\n\n\n

Before and After Behavior<\/h3>\n\n\n\n

A typical middleware method signature looks like this:<\/p>\n\n\n\n

public function handle($request, Closure $next)\n{\n    \/\/ Before: inspect or mutate $request\n    if ($request->isMethod('POST') && !$request->user()) {\n        abort(403, 'Unauthorized');\n    }\n\n    $response = $next($request);\n\n    \/\/ After: inspect or mutate $response\n    $response->headers->set('X-App', 'MyLaravelApp');\n\n    return $response;\n}<\/code><\/pre>\n\n\n\n
Terminable Middleware<\/h3>\n\n\n\n
To run logic after the response is sent to the browser (useful for logging, metrics, or async cleanup), implement a terminate<\/code> method in the same middleware:<\/p>\n\n\n\n
public function terminate($request, $response)\n{\n    \/\/ Runs after response is sent\n    \\Log::info('Request completed', ['path' => $request->path()]);\n}<\/code><\/pre>\n\n\n\n
\n\n\n\n
Types of Middleware in Laravel<\/h2>\n\n\n\n
Global Middleware<\/h3>\n\n\n\n
Global middleware runs on every request. Typical examples include trimming strings, converting empty strings to null, and maintenance mode checks. Use global middleware for cross cutting concerns that must always apply.<\/p>\n\n\n\n
Route Middleware<\/h3>\n\n\n\n
Route middleware is attached to specific routes or controllers. Common examples include auth<\/code>, verified<\/code>, signed<\/code>, and custom role\/permission checks. This provides fine grained control.<\/p>\n\n\n\n
Middleware Groups<\/h3>\n\n\n\n
Groups bundle multiple middleware for convenient assignment. Laravel includes two key groups:<\/p>\n\n\n\n