Middleware recipes
Reusable middleware patterns for auth, throttling, and tenancy.
Middleware keeps cross-cutting concerns out of controllers. Atlas 3.x middleware can be stacked, aliased, and parameterized.
Register an alias
phpbootstrap/app.php
// bootstrap/app.php
$middleware->alias([
'workspace' => EnsureWorkspaceAccess::class,
]);Protect a route group
phproutes/web.php
Route::middleware(['auth', 'workspace'])
->prefix('workspaces/{workspace}')
->group(function () {
Route::get('projects', [ProjectController::class, 'index']);
});Common recipes
| Need | Middleware | Notes |
|---|---|---|
| Authenticate | auth | Redirects guests |
| Throttle API | throttle:api | Uses RateLimiter |
| Force JSON | ForceJsonResponse | API groups |
| Workspace scope | workspace | 404 if unauthorized |
Tip
Keep middleware side-effect free beyond the request. Persist state in jobs or domain services instead.
api
Auth gates
Short-circuit unauthorized access.
folder
Rate limits
Bound noisy clients.
book
Content negotiation
Normalize Accept headers.
Updated Aug 5, 2026