What It Actually Means
Every request passes through it on the way in. It might check whether the user is logged in, apply a rate limit, log the request, or reject something malformed, before the specific handler ever runs.
Why It Matters Commercially
Because it is where rules go when they must not be forgotten.
The alternative is checking in each individual handler, which relies on every developer remembering, every time, including at four in the afternoon on a Friday. One omission produces a route with no permission check, and that omission is invisible until somebody finds it.
Middleware inverts that. The check happens because everything passes through it. Adding a new endpoint does not require remembering to secure it, because it is secured by default and exposing it requires a deliberate exception.
That is the difference between a system where security depends on discipline and one where it depends on structure, and it is the reason this obscure-sounding term is worth knowing.
Where It Is Typically Used
Authentication and authorisation. Establishing who is asking and whether they may.
Rate limiting. Preventing one caller from overwhelming the system or extracting data steadily.
Logging. Recording what was requested, which is what makes investigating anything possible afterwards.
Enforcing HTTPS, and setting the security headers browsers use.
Rejecting bad input before it reaches business logic.
The Question Worth Asking
Is our permission checking applied centrally, or written into each handler?
The answer describes how likely you are to have a route somebody forgot to secure.
The follow-up matters too: which routes are deliberately excluded. There are always some, a login page, a health check, a public form, and that list should be short, deliberate and reviewable. When exclusions are scattered rather than listed, nobody can say with confidence what is currently unprotected.
What To Ask
- Is authentication applied centrally? It should be, with exceptions listed rather than assumed.
- What is the list of routes that skip it? Short and intentional, or long and accumulated.
- Is anything rate-limited? Particularly login and anything returning data in bulk.
- What is logged about each request, and for how long? Necessary for investigating an incident, and it is personal data with a retention obligation.
What Not To Confuse It With
The word is used differently in enterprise software, where middleware sometimes means an entire integration platform sitting between systems.
In the context of a web application it means the layer described here: the checks and processing every request passes through. If a supplier uses the word in a proposal, it is worth establishing which sense is meant, because one is a structural detail of how the application is built and the other is a substantial piece of infrastructure with its own licence cost.
More terms are in the glossary.
