Middleware

Middleware models cross-cutting request steps in order—body parsing, authentication, authorization, logging, validation, error formatting, response compression. Each piece stays small and composable. The pattern appears in HTTP frameworks, GraphQL plugins, and message buses.

On interviews: trace a request through auth and error middleware. Discuss idempotency, context propagation, and failing closed on auth errors.

Common pitfalls: middleware order bugs that skip security; swallowing errors without mapping; heavy work in middleware that belongs in handlers.

The trade-off is flexibility versus complexity—know when the simpler path is enough.

Checklist:

• Security middleware runs before business handlers.
• Request context typed and immutable where possible.
• Errors mapped to consistent response envelope.
• Integration tests exercise middleware chain.