Middleware

Middleware is code that sits in the path of every request, doing the work common to all of them: checking authentication, logging, adding security headers, applying rate limiting, measuring how long the request took.

It exists so cross-cutting concerns are written once rather than repeated in every endpoint — which is also the security argument for it. An authentication check applied by middleware across a whole section cannot be forgotten on the one new endpoint somebody added in a hurry.

The care it needs is ordering, because middleware runs in sequence. Putting the logger before the authentication check means logging requests that were rejected; putting it after means never seeing them.