Middleware: request rules, input and output listeners #

This page is for developers who put cross-cutting request logic into middleware (Laravel, Slim, Laminas, Express, Django), before and after filters (Rails, CodeIgniter) or kernel listeners (Symfony). Exponential has no generic middleware stack you add classes to. It has three places that together cover most middleware uses.

Contents #

1. The three places
2. Request rules
3. Input and output listeners
4. Common middleware, translated
5. What has no equivalent

The three places #

The order inside a request is on The request lifecycle.

Request rules #

Rules are settings: conditions and an action, asked in order, the first whose conditions all match decides (Request rules, complete guide with sixteen recipes: View full security).

# settings/siteaccess/<site>/requestrules.ini.append.php
<?php /*
[RequestRuleSettings]
RuleList[]=members_area

[Rule-members_area]
Description=Below node 864, anonymous visitors sign in first and come back.
Conditions[subtree]=864
Conditions[user]=anonymous
Action=login
*/ ?>

• 25 conditions, among them requested_via (system, alias, wildcard, front page), uri, module_view, view_mode, node, subtree, class, section, state, user, role, policy, siteaccess, host, header, ip and fact.
• 8 actions: allow, notfound, forbidden, login, redirect, redirect_to_alias, rewrite, log.
• Rules only take access away or send the visitor elsewhere; they never give access a policy refused.
• Any answer except allow is sent private, no-store.
• Check what the rules decide without changing anything: php bin/php/ezrequestrules.php -s site --uri=content/view/full/2.

In PHP you can add conditions, actions, facts (ezpRequestFactProvider) and whole rule sets computed at run time (ezpRequestRuleProvider), registered in [RequestRuleSettings] (Extending the rules in PHP).

Input and output listeners #

ezformtoken is the model of a middleware pair in Exponential. Its settings/site.ini.append.php registers:

[Event]
Listeners[]=request/input@ezxFormToken::input
Listeners[]=response/output@ezxFormToken::output

ezxFormToken::input() checks the token of every POST before routing; ezxFormToken::output() adds the hidden token field to every method="post" form in the final HTML. A filter listener such as response/output must return the value it receives, changed or not (Events and listeners).

Common middleware, translated #

What has no equivalent #

• Per-route middleware lists (->middleware('auth') on one route): use view functions and request rules with a module_view condition.
• Wrapping the whole call in a closure ($next($request)): listeners run before or after, not around. The runnable events (runnable/view/before and after) come closest for a single view.
• Middleware ordering by priority: listeners run in the order of Listeners[]; rules in the order of RuleList[].

Related pages #

• Hardening
• Security for applications
• Event hook pattern
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.