# What Is Middleware? Meaning, Types, and Examples

> Middleware is intermediary software that connects applications or processes requests before they reach your code. Learn its functions, types, and examples.

**URL:** https://www.ciptadusa.com/blog/middleware-adalah  
**Type:** blog  
**Author:** PT Cipta Dua Saudara  
**Category:** Engineering  
**Published:** 2026-10-27  
**Cover:** https://www.ciptadusa.com/media/uploads/blog/2026-10/1793067783912-middleware-adalah-20261027.webp  

## Article

Middleware is intermediary software that sits between two parts of a system and manages the communication between them. AWS defines it as software that different applications use to communicate with each other, acting as a bridge between diverse technologies, tools, and databases ([source](https://aws.amazon.com/what-is/middleware/)). IBM calls it "software glue" that binds different systems together ([source](https://www.ibm.com/think/topics/middleware)).

The term is used in two contexts. First, middleware as a connector between applications, such as the layer that moves data from an online store into an ERP and a warehouse system. Second, middleware inside web frameworks such as Laravel, Express.js, or ASP.NET Core: functions that inspect and process every request before it reaches the main application code. This article covers both: the meaning, functions, how it works, types, examples, how it differs from APIs and the backend, and what a business should consider before using it.

## What Middleware Means

Literally, middleware is software that sits "in the middle". That middle position can be between a frontend and a backend, between two business applications, or between a user's request and the code that handles it.

AWS gives a simple example: a Windows frontend application sends and receives data from a Linux backend server, yet users are unaware of the difference because middleware bridges the two ([source](https://aws.amazon.com/what-is/middleware/)). Without middleware, according to AWS, developers would have to build a data exchange module for every software component that connects to the application.

If client side and server side are new terms for you, start with [what is a frontend](/en/blog/frontend-adalah) and [what is a backend](/en/blog/backend-adalah). Middleware lives on the path that connects the two.

### Two Meanings of Middleware

| Context | Example searches | What it refers to |
| --- | --- | --- |
| System integration and architecture | middleware server, middleware software, middleware engineer | Standalone software that connects applications, databases, and services, such as message brokers, API gateways, ESBs, or iPaaS |
| Web frameworks | Laravel middleware, API middleware, Express middleware | Functions or classes inside an application that process HTTP requests before and after they reach a route or controller |

Both share the same idea: an intermediary layer that inspects, transforms, or forwards data. The difference is scale. Integration middleware connects many systems, while framework middleware works inside a single application.

### A Brief History

IBM notes that the term middleware was first introduced in the late 1960s, because early versions acted as a mediator between an application front end (client) and a back-end resource such as a database or mainframe application ([source](https://www.ibm.com/think/topics/middleware)). AWS adds that middleware started as a bridge between new applications and legacy systems before gaining popularity in the 1980s ([source](https://aws.amazon.com/what-is/middleware/)).

## What Middleware Does

Based on the AWS and IBM explanations, the functions of middleware fall into a few groups:

- **Connecting different systems.** Applications written in different languages, operating systems, or data formats can still exchange data. IBM says middleware provides services that let components written in Java, C++, PHP, and Python talk to each other ([source](https://www.ibm.com/think/topics/middleware)).
- **Securing communication.** AWS says middleware provides secure communication channels between distributed applications ([source](https://aws.amazon.com/what-is/middleware/)). IBM adds authentication capabilities, such as challenging front-end requests for credentials or digital certificates ([source](https://www.ibm.com/think/topics/middleware)).
- **Managing traffic.** Middleware can distribute requests across multiple servers when traffic spikes, so a single server does not carry the whole load ([source](https://www.ibm.com/think/topics/middleware)).
- **Customizing responses.** AWS gives the example of middleware that sorts and filters results before sending them to the frontend ([source](https://aws.amazon.com/what-is/middleware/)). IBM describes an e-commerce application that sorts product search results by nearest store location, based on location information in the request header ([source](https://www.ibm.com/think/topics/middleware)).
- **Supporting modernization.** Middleware acts as a bridge when legacy applications are broken up or moved to a newer architecture without rewriting everything at once ([source](https://www.ibm.com/think/topics/middleware)).

At the framework level, the role is more specific. The Laravel documentation describes middleware as a mechanism for inspecting and filtering HTTP requests entering an application, with examples such as checking that a user is logged in, logging every request, and CSRF protection ([source](https://laravel.com/docs/13.x/middleware)).

## How Middleware Works

### Middleware as a Connector Between Applications

AWS explains that middleware abstracts the underlying communication between components, so a frontend application only talks to the middleware and does not need to learn the "language" of each backend component ([source](https://aws.amazon.com/what-is/middleware/)). Data is exchanged through standard messaging frameworks such as JSON, REST APIs, XML, web services, and SOAP.

An example from AWS: a web server is middleware that connects a website to its backend database. When you submit a form on a website, the browser sends a request in JSON or XML to the web server. The web server then runs business logic, retrieves data from the database, or communicates with other services ([source](https://aws.amazon.com/what-is/middleware/)).

According to AWS and IBM, integration middleware architecture is made up of several components: a management console, a client interface, an internal interface, a platform interface, a contract manager (data exchange rules), a session manager, a database manager, and a runtime monitor that tracks data movement ([AWS source](https://aws.amazon.com/what-is/middleware/), [IBM source](https://www.ibm.com/think/topics/middleware)). AWS gives an example of the contract manager at work: returning an exception when an application sends a number where text is expected.

### Middleware in Web Frameworks

Inside an application, middleware works like a series of checkpoints. Laravel describes it as a series of "layers" that HTTP requests must pass through before they hit the application, and each layer can examine the request or reject it entirely ([source](https://laravel.com/docs/13.x/middleware)).

Express.js uses the same concept. Its documentation says an Express application is essentially a series of middleware function calls during the request-response cycle. A middleware function can execute any code, modify the request and response objects, end the request-response cycle, or pass control to the next middleware with `next()`. If it neither ends the cycle nor calls `next()`, the request is left hanging ([source](https://expressjs.com/en/guide/using-middleware.html)).

The simplified flow:

1. A request arrives at the server.
2. The first middleware runs, for example recording the time and path of the request.
3. The next middleware checks the login session. If the user is not logged in, the request stops and the user is redirected to the login page.
4. If every check passes, the request reaches the route or controller that runs the business logic.
5. The response goes back to the user, and in some frameworks it passes through the middleware in reverse order.

Microsoft Learn confirms point five for ASP.NET Core: the order in which middleware is added determines the order in which it is invoked on requests, and the reverse order for responses. That order is described as critical for security, performance, and functionality ([source](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/middleware/?view=aspnetcore-10.0)).

## Types of Middleware

IBM divides middleware into two broad classes: enterprise application integration middleware and platform middleware ([source](https://www.ibm.com/think/topics/middleware)). Within them there are many types. Here is a summary of several types described by IBM:

| Type | What it does | Examples |
| --- | --- | --- |
| Message-oriented middleware (MOM) | Translates and routes messages between applications using different protocols, in the right order | Message queues, message brokers |
| Remote procedure call (RPC) | Lets one application trigger a procedure in another as if both ran on the same computer | RPC frameworks |
| Database middleware | Simplifies access to back-end databases | SQL database servers |
| API middleware | Tools to create, expose, and manage APIs | API gateways, API management platforms, developer portals |
| Transactional middleware | Drives data transactions across a network to completion | Transaction processing monitors |
| Asynchronous data streaming | Replicates a data stream in an intermediate store so many applications can use it | Apache Kafka |
| Enterprise application integration | An integration hub that connects all applications and processes | ESB, iPaaS |
| Platform middleware | A runtime environment for application logic | Java runtime, containers, application servers, CMS |

Table source: [IBM](https://www.ibm.com/think/topics/middleware). IBM also notes that the ESB was once the prevalent form of enterprise integration within SOA, and that iPaaS now lets organizations connect applications, data, and processes across on-premises and cloud environments without running the integration servers themselves.

## Middleware Examples

### Middleware in Business Systems

The following illustration describes a distributor that uses an online store, an ERP, a warehouse app, and a CRM. It is a made-up example to explain the concept, not a client case study:

- An **API gateway** receives every request from the sales team's mobile app, checks the API key, limits the request rate, and forwards the request to the order or stock service.
- A **message broker** holds the "new order" message from the online store. The ERP, the warehouse app, and the CRM each pick up that message, so the online store does not need to know how many systems are listening.
- An **iPaaS** copies new customer data from the website form into the [CRM](/en/blog/crm-adalah) and invoice data from the [ERP](/en/blog/erp-adalah) into the accounting software, with field mapping managed in one place.

A wider look at integration patterns, including point-to-point, hub-and-spoke, webhooks, and ETL, is in our article [what is system integration](/en/blog/integrasi-sistem-adalah).

### Middleware in Laravel

Laravel ships with middleware for authentication and CSRF protection. The authentication middleware checks whether the user is logged in. If not, the user is redirected to the login screen; if so, the request proceeds into the application ([source](https://laravel.com/docs/13.x/middleware)). New middleware is created with `php artisan make:middleware` and can be registered globally for every request, per route, or in groups such as the `web` and `api` groups ([source](https://laravel.com/docs/13.x/middleware)).

### Middleware in Express.js

Here is an Express middleware that logs the method and path of every request, then passes it on:

```js
app.use((req, res, next) => {
  console.log(req.method, req.url)
  next()
})
```

The Express documentation groups middleware into five types: application-level, router-level, error-handling, built-in, and third-party ([source](https://expressjs.com/en/guide/using-middleware.html)).

### Next.js Middleware Is Now Called Proxy

In Next.js, the `middleware` file convention is deprecated and was renamed to `proxy` in version 16.0.0. Proxy runs on the server before routes are rendered and is useful for logic such as authentication, logging, and redirects ([source](https://nextjs.org/docs/app/api-reference/file-conventions/proxy)). The Next.js team explains that the name "proxy" was chosen because the feature behaves like a network boundary in front of the app. If your Next.js project still uses `middleware.ts`, plan the migration as part of your next version upgrade. More Next.js security guidance is in [Next.js security and deployment](/en/blog/nextjs-security-deployment).

## Middleware vs API vs Backend

These three terms are related, but they are not the same:

| Term | Role | Analogy |
| --- | --- | --- |
| Backend | The server side that stores data and runs business rules | The restaurant kitchen |
| API | The contract or interface that defines how two pieces of software communicate | The menu and order format |
| Middleware | The intermediary layer that forwards, checks, or translates communication | The waiter who checks the order before passing it to the kitchen |

AWS defines an API as a mechanism that enables two software components to communicate with each other using a set of definitions and protocols ([source](https://aws.amazon.com/what-is/api/)). Middleware can offer a standard API for the components behind it, as AWS describes in its software development use case ([source](https://aws.amazon.com/what-is/middleware/)). So "API middleware" or an API gateway is middleware that manages API traffic, not the API itself.

The restaurant analogy in the table above is a CDS simplification for non-technical readers, not a formal definition.

## What to Watch When Using Middleware

### Order Determines the Outcome

Because middleware runs in sequence, the wrong order can let a security check be skipped or let a cache store data it should not. Microsoft Learn calls middleware order critical for security, performance, and functionality ([source](https://learn.microsoft.com/en-us/aspnet/core/fundamentals/middleware/?view=aspnetcore-10.0)). Document your application's middleware order and retest whenever it changes.

### Do Not Make It Your Only Line of Defense

In March 2025, Next.js patched critical vulnerability CVE-2025-29927, which allowed middleware to be bypassed through the internal `x-middleware-subrequest` header. Patches were released in Next.js 14.2.25 and 15.2.3. In its postmortem, the Next.js team stated that it does not recommend middleware as the sole method of protecting routes in an application ([source](https://nextjs.org/blog/cve-2025-29927)).

The lesson applies beyond Next.js: middleware is good for early checks, but permissions still need to be verified where data is read or changed, such as in a backend service or database query.

### Middleware Is Another Layer to Maintain

Every intermediary layer is a component that needs monitoring, updates, and security. For integration middleware such as message brokers or API gateways, set up logs, alerts, and a plan for when that layer stops working, because every system that depends on it is affected too. These monitoring and release practices are covered in [what is DevOps](/en/blog/devops-adalah), and you can estimate upkeep with our guide to [application maintenance costs](/en/blog/biaya-maintenance-aplikasi).

## When Does a Business Need Integration Middleware?

The list below is internal CDS guidance for early discussions, not a fixed rule. Integration middleware is worth considering when:

- More than two applications need to exchange the same data, such as customers, products, or orders.
- A single event (a new order, an incoming payment) must reach several systems at once.
- A legacy system cannot be changed, but a new application needs its data.
- The team wants one place to monitor, log, and retry failed data deliveries.
- APIs are opened to partners or mobile apps and need consistent access control and rate limiting.

If you only need to connect two applications with a simple flow, a direct API or webhook integration may be enough. Make this decision after mapping the data flow, not based on the name of a middleware product.

## Middleware in CDS Projects

Through its [custom software development service](/en/services/software), CDS builds web apps, mobile apps, internal tools, and API integrations with a stack that includes Laravel + PHP, Node.js, Go, React/Next.js, Cloudflare Workers, plus REST APIs and webhooks. The Ship stage covers QA, data migration, production deployment, and post-release monitoring. For companies already running many applications, CDS [IT consulting](/en/services/consulting) covers auditing dependencies between systems and designing a target architecture, including integration, security, and a phased migration path.

CDS's own product [Zetta CRM](/en/incubating/zetta-crm) uses a similar layered pattern: this Go-based MCP server receives requests at a `POST /mcp` endpoint and every call is gated by an API key, so AI agents reach CRM data through a single controlled entry point. You can see delivered projects on the [CDS works](/en/works) page.

## Middleware FAQ

### What is middleware in simple terms?

Middleware is intermediary software that connects two parts of a system or processes a request before it reaches the main code. Examples include an API gateway that connects a mobile app to backend services, or Laravel's login middleware that turns away users who are not signed in.

### What are examples of middleware?

Integration middleware examples from IBM include message brokers, API gateways, ESBs, iPaaS, and Apache Kafka ([source](https://www.ibm.com/think/topics/middleware)). AWS also describes a web server as middleware that connects a website to its database ([source](https://aws.amazon.com/what-is/middleware/)). In web frameworks, examples include authentication, CSRF, and logging middleware in Laravel.

### What is middleware in Laravel?

Middleware in Laravel is a class that inspects and filters HTTP requests before they enter the application, for example to make sure the user is logged in or a token is valid ([source](https://laravel.com/docs/13.x/middleware)).

### What is the difference between middleware and an API?

An API is a communication contract between pieces of software. Middleware is the layer that carries out, forwards, or manages that communication. An API gateway is an example of middleware that manages API traffic.

### Is middleware part of the backend?

Framework middleware runs on the server, so it is part of an application's backend. Integration middleware such as a message broker or iPaaS stands as a separate layer between several backends.

### How does middleware help application security?

Middleware can check authentication, limit requests, and secure communication channels. However, the Next.js team advises against making middleware the only protection for routes ([source](https://nextjs.org/blog/cve-2025-29927)). Permissions still need to be checked in the backend.

## Need Cleaner Integration Between Your Business Apps?

If your order, stock, customer, and finance data is spread across applications that do not talk to each other, the CDS team can map the data flow first and then choose the right approach: direct APIs, webhooks, or a middleware layer. Discuss your needs through our [custom software development](/en/services/software) page or start with [IT architecture consulting](/en/services/consulting).


---

*Markdown version of https://www.ciptadusa.com/blog/middleware-adalah — generated for AI agents and LLM crawlers.*