TOPIC
Middleware runs between a request arriving and a controller handling it — the mechanism behind auth checks, CORS headers, and rate limiting, all inspecting or modifying the request/response without the controller knowing.
The confirmed rule has one specific, easy-to-miss requirement: the confirmation field must be named exactly {field}_confirmation, or the rule silently never matches anything.
A minimal OTP login flow built on top of Laravel's own auth system — generate a code, email or text it, verify it, then log the user in — without reaching for a full package if you don't need one.
The most widely used role/permission package for Laravel — assigning roles, checking permissions in code and Blade, and the middleware that gates routes by role.
Setting up tymon/jwt-auth for a stateless API, and why JWT is the wrong choice for a normal server-rendered app with sessions.
PDO is the modern, framework-agnostic way to talk to MySQL from plain PHP — and prepared statements aren't optional if user input touches the query.
The Hash facade, why bcrypt/argon2 hashes look different every time for the same password, and the correct way to verify a login without ever decrypting anything.
The Crypt facade, AES-256-CBC under the hood, and why encrypted values are not the right tool for anything you need to search or index in the database.
Laravel 11 removed app/Http/Kernel.php — here is how middleware registration actually works now, with a working example.
