Why this lesson matters

Understand middleware and apply it in a small Laravel feature. Middleware handles request-wide checks, authentication establishes identity, sessions preserve trusted state, and authorization decides whether that identity may perform a specific action.

How to reason about it

  • For Middleware, the outcome to verify is: Place shared request checks before controller execution.
  • In Middleware, keep this failure controlled: Hiding a button is not authorization; every protected mutation must enforce the permission or policy on the server.
  • Middleware practice target: Protect one route with authentication and a policy, then verify unauthenticated, forbidden and allowed cases separately.
Diagram

Middleware in the request lifecycle

Practical walkthrough

In the Middleware walkthrough: Place shared request checks before controller execution.

app/Http/Middleware/EnsureAccountActive.phpphp
public function handle(Request $request, Closure $next): Response
{
    abort_unless($request->user()?->is_active, 403);
    return $next($request);
}

Practice it yourself

Practice

Middleware exercise

Protect one route with authentication and a policy, then verify unauthenticated, forbidden and allowed cases separately.

  • Record the expected result before execution
  • Test one valid path and one lesson-specific failure path
  • Explain in two lines which boundary owns the decision

Summary