
Organize routes, secure them, and keep controllers lean
The final topic that I wanted to touch upon in the web.php file are routing groups. We’re not fully finished talking about routes considering that we really haven’t even touched on the api.php file, which is used frequently as well.
https://www.dinocajic.com/laravel-p53-rate-limiting/
We looked at route groups in an earlier article. If you need a refresher, you may check it out here.
https://medium.com/geekculture/laravel-p23-route-groups-8d4ce3e8e083
What I really wanted to focus on here is adding middleware to a group and grouping a specific controller.
Applying Middleware to a Group
To apply middleware to a specific group, you simply use the Route::middleware method, add the specific middleware that you want to apply, chain on a group method and pass an anonymous function with the various routes that should have the middleware applied to them.
We’ve seen an example of applying middleware to a group in the previous article.
Route::middleware(['throttle:web'])->group(function () {
Route::get('/throttle-test-1', function() {
return "Throttle Test 1";
});
Route::get('/throttle-test-2', function() {
return "Throttle Test 2";
});
});
If we wanted to apply additional middleware to our group, we simply add the additional items to our middleware array. For example, let’s say that we wanted to append auth as well.
Route::middleware(['throttle:web', 'auth'])->group(function () {
Route::get('/throttle-test-3', function() {
return "Throttle Test 3";
});
Route::get('/throttle-test-4', function() {
return "Throttle Test 4";
});
});
If we visit either of the routes right now, we’re going to get an error since we haven’t implemented authentication yet. However, we do see that the middleware is working. It’s looking for the login route in app/Http/Middleware/Authenticate.php.

Middleware is executed in order, which means that for [‘throttle:web’, ‘auth’], the throttle:web middleware will execute first, followed by auth.
Controllers
You may remember the following example from our car project:
Route::prefix('/personalcars')->group(function() {
Route::get('/', [PersonalCarController::class, 'index']);
Route::get('/create', [PersonalCarController::class, 'create']);
Route::post('/', [PersonalCarController::class, 'store']);
Route::get('/{id}', [PersonalCarController::class, 'show']);
Route::get('/{id}/edit', [PersonalCarController::class, 'edit']);
Route::put('/{id}', [PersonalCarController::class, 'update']);
Route::delete('/{id}', [PersonalCarController::class, 'destroy']);
});
For each of the routes we added the PersonalCarController::class. That seems like a ton of repetition. We could pull out the PersonalCarController class out of there and apply it to the whole group.
Route::controller(PersonalCarController::class)->group(function () {
Route::get('/', 'index');
Route::get('/create', 'create');
Route::post('/', 'store');
Route::get('/{id}', 'show');
Route::get('/{id}/edit', 'edit');
Route::put('/{id}', 'update');
Route::delete('/{id}', 'destroy');
});
That seems a lot cleaner. In this instance, if we ever need to modify the controller name, we simply do it in one spot.
That’s it for routes. We’re going to be moving into some additional Laravel concepts next. We’ll definitely revisit middleware soon.
Laravel Series
Continue your Laravel Learning.
Throttle traffic, keep your API safe
In part 53 of our Laravel series, learn to throttle traffic with customizable rate limits. Explore global and per‑route strategies, dynamic keys, back‑off responses, and API protection techniques to keep your application stable under load.
Organize routes, secure them, and keep controllers lean
Laravel – P54: Route Groups Middleware & Controllers
In part 54 of our Laravel series, unlock the power of route groups to apply middleware stacks and shared controller namespaces in one stroke. Minimize repetition, harden security, and keep your routes file tidy as your API grows.
Route to trashed records with confidence
Laravel – P55: Routes Soft – Deleted Models
In part 55 of our Laravel series, learn how to work with soft-deleted Eloquent models inside routes. Configure bindings to include trashed records, build restore endpoints, and prevent 404 errors when referencing archived data.


