Week 14: Middleware, Form Requests & File Uploads

1. What Middleware Actually Is

Middleware sits between the incoming request and your controller, able to inspect, modify or reject the request before it arrives — or modify the response on the way back out. auth from last week is middleware; so is CSRF protection, which Laravel applies to every web route by default:

Request
  → Middleware 1 (e.g. TrustProxies)
    → Middleware 2 (e.g. VerifyCsrfToken)
      → Middleware 3 (e.g. auth)
        → Controller
      ← Middleware 3 (can act on the way back out too)
    ← Middleware 2
  ← Middleware 1
Response

This is precisely the "structural separation of code from data" idea from Week 7, applied to request handling: cross-cutting concerns (auth checks, CSRF validation, logging) live in one reusable layer instead of being repeated inside every controller method.

2. Writing Custom Middleware

A middleware class has one handle() method: inspect the request, decide whether to let it continue ($next($request)) or short-circuit it:

php artisan make:middleware EnsureUserIsAdmin

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class EnsureUserIsAdmin
{
    public function handle(Request $request, Closure $next): Response
    {
        if ($request->user()?->role !== 'admin') {
            abort(403, 'Admins only.');
        }

        return $next($request); // continue to the next middleware / the controller
    }
}

<?php

use App\Http\Middleware\EnsureUserIsAdmin;

->withMiddleware(function ($middleware) {
    $middleware->alias(['admin' => EnsureUserIsAdmin::class]);
})

<?php

Route::middleware(['auth', 'admin'])->group(function () {
    Route::get('/admin/users', AdminUserController::class);
});

Middleware stack in order: auth runs first (must be logged in at all), then admin (must specifically be an admin) — each one independently reusable across any route that needs it.

3. Form Request Authorization

Week 10 left authorize() returning true unconditionally. Now that Policies exist, a Form Request's authorize() is the right place to enforce per-request authorization before validation even runs:

<?php

namespace App\Http\Requests;

use App\Models\Task;
use Illuminate\Foundation\Http\FormRequest;

class UpdateTaskRequest extends FormRequest
{
    public function authorize(): bool
    {
        $task = $this->route('task'); // route model binding still applies inside a Form Request
        return $this->user()->can('update', $task);
    }

    public function rules(): array
    {
        return [
            'title' => 'required|string|max:200',
            'is_done' => 'boolean',
        ];
    }
}

If authorize() returns false, Laravel throws a 403 automatically before rules() is even evaluated — authorization and validation both happen before a single line of the controller method's body runs.

4. The Storage Facade

Week 10 briefly used $request->file(...)->store(...). The Storage facade is the fuller API behind it — configurable across local disk, S3, or any other supported driver, without changing your application code:

<?php

use Illuminate\Support\Facades\Storage;

public function store(StoreTaskRequest $request)
{
    $data = $request->validated();

    if ($request->hasFile('attachment')) {
        $data['attachment_path'] = $request->file('attachment')
            ->store('attachments', 'public'); // stores under storage/app/public/attachments/
    }

    $request->user()->tasks()->create($data);

    return redirect()->route('tasks.index')->with('success', 'Task created!');
}

'disks' => [
    'local' => ['driver' => 'local', 'root' => storage_path('app/private')],
    'public' => ['driver' => 'local', 'root' => storage_path('app/public'), 'url' => env('APP_URL').'/storage'],
    's3' => ['driver' => 's3', /* ... credentials from .env ... */],
],

Swapping 'public' for 's3' in the store() call — with S3 credentials configured in .env — moves uploads to cloud storage with no other code changes. That configurability is the actual point of routing uploads through Storage instead of calling move_uploaded_file() directly the way Week 5 did.

5. Serving Files Back

Files stored on the public disk need a symlink from public/storage to storage/app/public before they're reachable over HTTP — a one-time setup step:

php artisan storage:link

@if ($task->attachment_path)
  <a href="{{ Storage::url($task->attachment_path) }}">View attachment</a>
@endif

For files that shouldn't be publicly reachable by URL guessing — user documents, private uploads — store on the default (non-public) disk instead, and stream them through a controller route that checks authorization first:

<?php

public function downloadAttachment(Task $task)
{
    $this->authorize('view', $task); // same Policy mechanism from last week

    return Storage::download($task->attachment_path);
}

6. Hands-on Exercise

7. Knowledge Check

Four quick questions. Expand each to check your answer.