PHP API Middleware

Code Around Every Handler

Middleware is code that runs around your handlers: before the request reaches them, after the response leaves them, or instead of them. Logging, authentication, rate limiting, compression — all middleware.

The same idea travels under three names: web frameworks say middleware, gRPC says interceptor, some ecosystems say filter. One concept, three vocabularies.

In PHP, middleware is a function that takes a handler — any callable — and returns a wrapped callable: exactly the Decorator pattern from the design patterns group, and a stack of them behaves like a Chain of Responsibility.

A Logging Middleware

withLog wraps any handler: it logs the request coming in, lets the handler work, and logs again on the way out. The handler itself stays completely unaware.

The server runs as a separate process, so its log cannot reach the demo's terminal by itself — the middleware appends to a small log file, and the demo prints the fresh log lines after each request.

Wrap once, log everything

The wrapped handler serves two different paths and both get logged — the logging is written once, in the wrapper, not in every handler.

Prompt
Write a PHP script with a withLog middleware that wraps a handler callable, logging an arrow line with the method and path before calling the next handler and a done line after. Route two paths through the wrapped handler, serve it with the built-in server, request both paths and print the log lines and the responses.
Output: PHP script
Wrap once, log everything

Middleware That Stops the Request

Middleware can also refuse: an auth check that finds no valid key answers 401 Unauthorized and never calls the next handler.

Chained as withLog(withAuth($handler)), the request passes through the layers in order — and the response bubbles back out through them.

An auth layer in the chain

The request without a key is stopped by the auth layer with 401 — the handler never runs. With the key, the request passes the whole chain and reaches the data.

Prompt
Write a PHP script with two chained middlewares: withLog logging the request, and withAuth checking the X-API-Key header and answering 401 without calling the next handler when the key is wrong. Wrap a data handler as withLog(withAuth($handler)), serve it with the built-in server, then send one request without the key and one with it, printing both statuses and bodies.
Output: PHP script