The Request–Response Flow
A member opens http://lendly.test/books, and a list of books appears. Between those two moments, Laravel runs the request through a fixed series of stops. Once you know the order, every file you meet later has a place: "this runs before routing", "this runs inside the controller".
The rule
One door in, middleware around, router in the middle, same way out.
Follow the request:
public/index.php: the web server sends every request here. It is the only PHP file the outside world can reach.bootstrap/app.php:index.phploads Composer's autoloader, then asks this file to build the application. This is where routing files, middleware and exception handling are configured.- Boot: Laravel loads configuration, sets up error handling and runs the service providers, which register the app's pieces.
- Global middleware: layers that every request passes through, such as trimming whitespace from input or showing a "back soon" page while the site is in maintenance mode.
- Router: matches the method and path against
routes/web.php, runs that route's own middleware, such as sessions and CSRF protection, then calls the closure or controller. - Response: whatever the controller returns, whether a view, JSON or a redirect, is turned into a response object.
- Back out: the response passes back through the same middleware in reverse, then
index.phpsends it to the browser.
In Laravel 11 and 12, bootstrap/app.php is short and readable:
return Application::configure(basePath: dirname(__DIR__))
->withRouting(
web: __DIR__.'/../routes/web.php',
commands: __DIR__.'/../routes/console.php',
health: '/up',
)
->withMiddleware(function (Middleware $middleware) {
//
})
->withExceptions(function (Exceptions $exceptions) {
//
})->create();The shortcut
Picture an onion. The controller is the centre, and middleware layers wrap it. A request cuts inward through every layer, and the response comes back out through the same layers. When something happens "to every request", look at the layers. When it happens "on one page", look at the centre.
The door
public/index.phpreceives the request.
The trap is thinking each route file is its own entry point. There is only one door, public/index.php, and routes are just a lookup table the router checks.
Drills
Answer fast — trust the rule.
Which file receives every web request first?
Where do you configure middleware and routing files in Laravel 11 or 12?
Which comes first for a request to /books?
What happens to the response after the controller returns it?
Remember
- One door in, middleware around, router in the middle, same way out.
- Picture the onion: "every request" means middleware, "one page" means controller.
- Trap: route files are a lookup table, not entry points.