Code that runs around requests.
WHAT MIDDLEWARE IS
Code that runs before or after a request is handled.
WHAT IT IS USED FOR
Requiring authentication Checking permissions Rate limiting Request protection Logging Modifying requests or responses
WHY IT EXISTS
So concerns applying to many routes are declared once.
WHAT THE FRAMEWORK PROVIDES BY DEFAULT
Session handling Cross-site request protection Authentication
WHAT TO ASSIGN WHERE
Globally, for things applying to every request To groups, for things applying to a category To individual routes, for specific cases
WHAT TO WRITE YOUR OWN FOR
Checks repeated across routes.
WHAT TO BE CAREFUL WITH
Middleware performing heavy work on every request Order, which determines what runs first
WHAT ORDER MATTERS FOR
Authentication before permission checks Anything depending on a session running after session handling
WHAT TO CHECK
Which middleware applies to each route.
WHAT NOT TO DO
Disable default middleware to make something work.
