Middleware, Filters & Interceptors

Each element wraps the entire remainder of the chain as one callable. It receives the request, may act on it, then explicitly invokes that remainder; if it never invokes it, the request never reaches the handler.

A correlation id must exist before anything downstream writes a log line, records a metric or calls another service, so the hook that adopts or generates it runs first. Anything registered ahead of it emits records nothing can join.

A hook running before routing sees the raw message and the connection: method, request-target string, headers, client address, an unread body. The route template, path variables, handler, bound arguments and return value do not exist yet.

By default, registration order is inbound execution order: the first hook registered becomes the outermost layer and runs first, each one delegating inward, with the matched route handler innermost and running last.

Scope decides which requests enter the hook. A globally attached hook runs for every request the server accepts, including ones that match no route; a route- or group-scoped hook runs only for requests whose matched route sits inside that scope.

Because the delegate call never returned normally: the unwind jumps past the statements that follow it. Only a cleanup construct around the call still runs, and only a catch lets the hook observe the failure at all.

Skipping the call removes the handler and everything after it: the client gets a default answer or waits for a timeout. Invoking twice runs the whole remainder twice, duplicating side effects while the client still sees one response.

Access logging and request metrics belong at the outer edge of the chain, just inside the correlation-id hook, so they observe every request — including those an inner hook rejects — and time the whole pipeline, not just the handler.

Each altitude sees more application meaning and less of the wire: the server edge sees connection facts and raw bytes, a pipeline hook the framework's request and response objects plus the route, a handler-aware hook the bound arguments and return value.

The chain ends there: every hook nested inside and the route handler are skipped entirely. The hooks already entered around it still resume normally, so their after-phases run and can log, time or decorate that early response.

Carve the exemption out structurally: register the public endpoints in their own scope and attach authentication to the protected scope. If an exclusion list is unavoidable, match the routed identity exactly rather than a raw path prefix, and test the exempt set.

Before the call only the request exists, so that phase validates, tags, adjusts and starts timers. After it returns the response exists, so that phase logs status and size and may change headers only if nothing has been sent.

A browser sends the preflight without credentials, so an authentication hook placed ahead of the CORS hook answers it with a 401 carrying no CORS headers, and the browser blocks the real request. CORS must run first.

Each hook wraps the rest of the chain, so control returns inside-out: the innermost hook sees the response first and the first-registered, outermost hook sees it last, making outbound order the mirror of inbound order.

Everything the server accepts but never routes: paths matching no route, methods the matched path does not support, requests rejected for a malformed line or oversized body, framework-handled redirects and preflight replies, and anything a wider hook answered before routing happened.

Nesting usually decides, not registration order. The chain is assembled from the outside in, so the wider scope's hooks wrap the narrower scope's, and registration order only breaks ties within one scope. Some frameworks add explicit priorities that can cut across scopes.

A chain can only unwind a call that is still in progress. Detached work finishes after the chain has already returned, so no frame is left to unwind into and no element in the request path ever sees the failure.

Because the error stage is itself a chain element whose reach is exactly what it encloses. A hook registered outside it is never inside its catch, so anything that hook throws unwinds straight past it into the framework's last-resort path.

Mutate in place to attach something nobody else owns, such as a correlation value. Pass a replacement when overriding what the handler reads or wrapping the response, and remember a replacement is visible only to what you delegate with.

Before authentication the only key available is the network address, and that tier exists to protect the credential-checking path itself. After authentication the limiter can key by principal and enforce the per-account quota the product actually promises.

A handler-aware hook runs only when a handler is invoked, so anything refused earlier — no route match, wrong method, unacceptable media type, a body that failed to convert, an outer credential check — is answered without ever reaching it.

Find the framework's ordering rule first — explicit order values, then named phases, then registration sequence — and make ordering-sensitive hooks state their position explicitly, because equal-ranked hooks fall back to incidental discovery order that can change without warning.

Keep in the chain whatever needs application knowledge: the matched route, the principal, the tenant, the meaning of a failure. Push to the edge what is uniform and must act before traffic arrives. A few concerns belong in both.

The decision must run at or below the altitude of the latest fact it needs: capture the connection fact at the outermost hook into per-request state, then decide deeper, where the operation identity exists. Facts travel inward, never outward.

Attach it to the completion of the pending result and return the composed result outward. Code written as the next statement runs while the inner work is still in flight, so it sees no response and releases resources too early.

Compression wraps the response on its way out, so it belongs outside every element that can produce a body — handler, error stage and static assets alike. Placed too deep it silently misses responses produced outside it.

Default to one place that turns failures into responses and let every other hook observe and rethrow. Permit recovery only where the concern is optional, the degraded outcome is defined, and the recovery is counted rather than silent.

Branch the route tree by caller audience rather than by feature, give each branch one explicit chain, and reserve predicates inside hooks for genuinely runtime conditions. The hooks running for an endpoint should be readable from its registration.