What is Middleware?

What is Middleware?

Middleware is code that intercepts requests before they hit your route handlers. It's been around since the 1960s in message-oriented systems, but in web dev it means functions that run in sequence during the request lifecycle. In Next.js (stable since v13), middleware runs at the edge before your page or API route resolves—perfect for auth checks, redirects, A/B tests, geo-routing. Cold starts under a millisecond. In Express, middleware is the framework—every app.use() registers one. Common pattern: verify a JWT in middleware so your handlers never see unauthenticated requests.

How it works

Middleware functions get a request, optionally modify it, then either pass control to the next function or return a response. Execution model varies by framework.

Express.js pattern:

// Express middleware — runs on every request
app.use((req, res, next) => {
  const token = req.headers.authorization?.split(' ')[1];
  if (!token) return res.status(401).json({ error: 'No token' });
  try {
    req.user = jwt.verify(token, process.env.JWT_SECRET);
    next(); // pass to next middleware or route handler
  } catch {
    res.status(403).json({ error: 'Invalid token' });
  }
});

Next.js pattern (middleware.ts at project root):

import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';

export function middleware(request: NextRequest) {
  const country = request.geo?.country || 'US';
  if (country === 'DE') {
    return NextResponse.redirect(new URL('/de', request.url));
  }
  return NextResponse.next();
}

export const config = {
  matcher: ['/((?!_next|favicon.ico).*)'],
};

Next.js middleware runs in the Edge Runtime—a V8 isolate with no Node.js APIs like fs or net. Keeps execution fast (typically under 5ms at Vercel's edge) but limits what you can do. You can't query a traditional database directly. You'd use an edge-compatible client like Neon's serverless driver or Upstash Redis.

The mental model: middleware is a pipeline. Each function continues the chain or short-circuits it. Order matters. Run auth middleware before rate-limiting if you want to rate-limit per user.

When to use it

Middleware shines when you need logic across many routes without copy-pasting into every handler.

Use middleware when:

• Authentication/authorization checks need to happen before any route logic
• You need request-level redirects (locale, A/B tests, feature flags)
• Adding headers like CSP, CORS, or cache-control across all responses
• Logging and request tracing (attach a request ID early in the pipeline)
• Rate limiting at the edge before hitting your origin server

Skip middleware when:

• Logic is specific to a single route—just put it in the handler
• You need heavy computation or long-running processes (middleware should be fast)
• You're tempted to put business logic there—middleware is infrastructure, not domain logic
• You need full Node.js APIs in Next.js (Edge Runtime restrictions will bite you)

We've shipped middleware on 50+ projects. Rule of thumb: if you're copy-pasting the same 5 lines into multiple route handlers, it belongs in middleware.

Middleware vs alternatives

Next.js middleware replaced the custom server setups that were common pre-v12. Astro added middleware in 2.6 (2023) with a similar onRequest hook model.

Real-world example

On a SaaS we shipped in early 2026, we used Next.js 15 middleware to handle multi-tenant routing. The app served 12 white-label clients from a single deployment. Middleware read the Host header, looked up the tenant config from Upstash Redis (edge-compatible, ~2ms round trip), and rewrote the request to the correct tenant-specific layout.

Without middleware, we'd have needed either 12 separate deployments or a clunky client-side tenant resolution that would've added 200-400ms to every page load. The middleware approach kept TTFB under 120ms globally across Vercel's edge network. Total middleware execution time averaged 4ms per request based on our observability data from Axiom.