Global middleware is code in Laravel that runs for each HTTP request, which works on all requests, not limited to specific routes or groups. They are usually used to handle tasks such as CORS header, maintenance mode checking, input standardization, etc. Common built-in global middleware include HandleCors, TrustHosts, PreventRequestsDuringMaintenance, ValidatePostSize and TrimStrings. These classes are defined in the app/Http/Middleware directory and are registered through the $middleware attribute in App\Http\Kernel. To add custom global middleware, you can create a middleware class using the php artisan make:middleware command, write logic in the handle() method, and add it to the $middleware array without registering through the route or controller. However, it should be noted that global middleware will affect all types of requests (such as APIs, static resources). If it only needs to be applied to specific scenarios, middleware groups should be considered; at the same time, performance-sensitive operations such as database calls should be used with caution to avoid affecting overall performance. In short, global middleware is suitable for handling cross-sectional tasks, but it needs to be used reasonably to avoid side effects.

Global middleware in Laravel are pieces of code that run on every single HTTP request that comes into your application. They sit at the global level, meaning they're not tied to any specific route or group — they apply universally.

Unlike route-specific middleware (like ones that check for authentication or user roles), global middleware affect everything. The most common examples are things like starting a session, checking maintenance mode, or handling CORS headers. These are background tasks you want to happen no matter which page someone is hitting.

Common Global Middleware in Laravel

Laravel ships with several middleware out of the box that are typically registered globally. These include:

• HandleCors : Handles Cross-Origin Resource Sharing (CORS) headers.
• TrustHosts , TrustProxies : Deal with secure connections and reverse proxies.
• PreventRequestsDuringMaintenance : Blocks access when the app is in maintenance mode.
• ValidatePostSize : Checks if incoming POST requests are within allowed size limits.
• TrimStrings , ConvertEmptyStringsToNull : Handle input normalization.

These are all middleware classes that live in the app/Http/Middleware directory and are applied automatically via the global() method inside the App\Http\Kernel class.

How to Add Custom Global Middleware

If you have logic you want to run on every request — like logging IP addresses, setting timezone based on user location, or custom rate limiting — you can create your own middleware and register it globally.

Here's how:

1. Run php artisan make:middleware YourMiddlewareName
2. Write your logic inside the handle() method
3. Add the middleware class to the $middleware property in App\Http\Kernel

You don't need to use Route::middleware() or assign them in controller constructors — just placing them in the global list makes them active everywhere.

For example, if you wanted to log everything incoming request before anything else happens, you could write a simple logger middleware and register it at the top of the $middleware array.

When Not to Use Global Middleware

Just because something runs on every request doesn't always mean it should. Global middleware runs for every HTTP request — including API calls, asset requests, and AJAX endpoints. If your logic only needs to run on web pages or authenticated routes, consider using middleware groups ( web , api ) instead.

Also, be careful with performance. A slow global middleware will impact every single endpoint in your app. So, if you're making database calls or external API requests inside global middleware, make sure they're optimized and not blocking unnecessarily.

Final Note

Global middleware are powerful but easy to overlook — they quietly do their job behind the scenes. You don't usually notice them until something goes wrong (like a missing CORS header or an incorrectly trusted proxy). Once you understand how they fit into the overall request lifecycle, they become a solid tool for handling cross-cutting concerns in your Laravel apps.

Basically that's it.

The above is the detailed content of What are global middleware in Laravel?. For more information, please follow other related articles on the PHP Chinese website!