Middleware in Laravel 11 acts as a filter for HTTP requests before they reach your application logic. It is commonly used for authentication, authorization, logging, and security checks. In Laravel 11, authentication middleware ensures that only logged-in users can access protected routes.

In this guide, we’ll cover:
✅ What middleware is in Laravel 11
✅ How to create custom authentication middleware
✅ How to register middleware in bootstrap/app.php (new in Laravel 11)
✅ How to apply middleware to routes
✅ Using built-in authentication middleware

---

What is Middleware in Laravel 11?

Middleware is a layer between a request and the application logic. It helps control access to different parts of your application. Laravel provides default middleware for:

• auth – Restricts access to authenticated users.
• guest – Restricts access to non-authenticated users.
• throttle – Limits the number of requests per minute (rate limiting).
• verified – Ensures the user has verified their email.

You can also create custom middleware for role-based access control (RBAC), API authentication, logging, and custom security checks.

---

Step 1: Create Authentication Middleware

To create a new custom authentication middleware in Laravel 11, run the following command:

This creates a new middleware file in app/Http/Middleware/AuthMiddleware.php.

Modify the Middleware Logic

Open app/Http/Middleware/AuthMiddleware.php and update the handle method:

Explanation:

✔️ If the user is authenticated (auth()->check()), the request proceeds.
✔️ If the user is not authenticated, it returns a 401 Unauthorized response.

---

Step 2: Register Middleware in Laravel 11

Unlike previous versions, Laravel 11 no longer uses Kernel.php to register middleware. Instead, you register middleware in bootstrap/app.php.

Register Middleware in bootstrap/app.php

Open bootstrap/app.php and add your middleware:

To register route-specific middleware, use:

---

Step 3: Apply Middleware to Routes

Now that we’ve registered our custom authentication middleware, we can apply it to routes.

Protect Routes Using Middleware

Modify routes/web.php or routes/api.php:

Now, only authenticated users can access /dashboard. Unauthenticated users will receive a 401 Unauthorized error.

---

Step 4: Using Laravel’s Built-in Authentication Middleware

Laravel 11 comes with pre-built authentication middleware that you can use.

1. Using auth Middleware

You can apply Laravel’s built-in auth middleware like this:

If a user is not logged in, Laravel will redirect them to the login page.

---

Step 5: Redirect Unauthorized Users to Login

Instead of returning a 401 Unauthorized error, you can redirect users to the login page.

Modify app/Http/Middleware/AuthMiddleware.php:

Now, unauthenticated users will be redirected to /login.

---

Step 6: Secure API Endpoints with Middleware (Using Laravel Sanctum)

For API authentication, use Laravel Sanctum.

1. Install Sanctum

Run this command:

2. Publish and Run Migrations

3. Register Sanctum Middleware

Modify bootstrap/app.php:

4. Protect API Routes with Middleware

Modify routes/api.php:

Now, only authenticated users with a valid API token can access the /user route.

---

Conclusion

Laravel 11 has simplified middleware registration by moving it to bootstrap/app.php. You can:

✅ Use Laravel’s built-in authentication middleware (auth, auth:sanctum).
✅ Create custom authentication middleware to secure routes.
✅ Redirect unauthorized users to a login page.
✅ Secure API endpoints with Laravel Sanctum.

By implementing authentication middleware, you can protect routes, enforce security policies, and enhance your Laravel 11 application. 🚀

📌 For more details on Laravel middleware, visit:
👉 Laravel Middleware Documentation

To dive deeper, explore the Laravel 11 Guide for the latest updates and best practices.