PHP
Auth middleware
Learn to write an auth middleware that checks the session.
Auth middleware
An auth middleware checks the session before allowing access to protected routes. The most common pattern: it looks for $_SESSION['user_id']; if missing, it returns an unauthorized response and never calls $next.
This is an early return. When you write if (!isset($_SESSION['user_id'])) { return 'unauthorized'; }, inner layers are skipped and the request returns immediately.
Place auth near the outer edge of the pipeline so protected areas can be rejected before any work runs. You no longer need a separate if in every route.
Protected routes
When you add an auth middleware to a buildPipeline chain, every request on that route first goes through this check. If $_SESSION is empty, the request stops; $finalHandler is never called.
This removes the need to write a separate if in each route. Open routes (login, signup) go through without auth; closed routes (dashboard, settings) chain with auth.
For testing you can simulate a guest with unset($_SESSION['user_id']) and a member with $_SESSION['user_id'] = 42.
Exercise Write an authMiddleware
Define an authMiddleware($request, $next) function. If $_SESSION['user_id'] is not set, return "unauthorized" (early return). Otherwise return the result of $next($request). session_start() is already called. First call with unset($_SESSION['user_id']); then set $_SESSION['user_id'] = 42 and call again. Print each result.
Show example solution
Write function authMiddleware($request, $next) { if (!isset($_SESSION['user_id'])) { return "unauthorized"; } return $next($request); }. Then unset($_SESSION['user_id']); echo authMiddleware("panel", function ($r) { return "show panel"; }) . "\n"; and $_SESSION['user_id'] = 42; echo authMiddleware("panel", function ($r) { return "show panel"; }) . "\n";.
Example solution:
<?php
session_start();
function authMiddleware($request, $next) {
if (!isset($_SESSION['user_id'])) {
return "unauthorized";
}
return $next($request);
}
unset($_SESSION['user_id']);
echo authMiddleware("panel", function ($r) { return "show panel"; }) . "\n";
$_SESSION['user_id'] = 42;
echo authMiddleware("panel", function ($r) { return "show panel"; }) . "\n";
Test yourself
-
What should an auth middleware do when the user is not logged in?
- Ignore the error and continue
- Return an unauthorized response and do not call $next
- Start a new session
- Write to the database
Show answer
Return an unauthorized response and do not call $next — Correct. When unauthorized, $next is not called; inner layers are skipped.
-
Match the auth concepts
- $_SESSION['user_id']
- Logged in user
- early return
- Skips inner layers
- unauthorized
- Rejected response
- $next($request)
- Move to the next step
-
Early return
if (!isset($_SESSION['user_id'])) {
return ____;
}
Show answer
if (!isset($_SESSION['user_id'])) {
return "unauthorized";
}
Next lesson: Logging middleware
