This page needs a newer browser to run its tools. You can still read everything here.

Requests, routing and middleware interview questions

Interview questions on requests, routing and middleware: warm-ups, then what each harder question tests and how a good answer starts.

23 questions: 6 warm-ups and 17 with model answers · Levels: Fresher to senior

Warm-up questions

Short questions with short answers, each answered in full.

Fresher

In which order do the register and boot methods of service providers run, and why does the order matter?

Answered in the lesson How Laravel handles a request
Fresher

What is the difference between a 404 and a 405 from the router?

Answered in the lesson Routing, route parameters and URL generation
Fresher

What is the difference between work done before $next($request) and work done after it in a middleware?

Answered in the lesson Middleware and rate limiting
Fresher

What does route model binding do, and when does it answer 404?

Answered in the lesson Controllers and route model binding
Fresher

What do TrimStrings and ConvertEmptyStringsToNull do to input, and what does that mean for validation?

Answered in the lesson Requests, input and uploaded files
Fresher

What is flash data, and how long does it live?

Answered in the lesson Responses, redirects, sessions and cookies

Questions with model answers

What each question tests, the first step of a good answer and the follow-ups to expect.

Fresher to mid

A teammate adds a SecurityHeaders middleware to the web group. The monitoring check on /up and the JSON routes under /api come back without the headers. Explain why, and say where you would register it instead.
What it tests

Knowing which requests a global middleware, a middleware group and a route outside every group each wrap, and how to prove the answer with a request.

First step

List what the web group wraps: only the routes loaded into it. Then check where /up and the api routes are registered, and decide whether headers are a rule for every response or only for browser pages.
Follow-ups
- Does a global middleware also add the headers to a 404 for a URL no route handles?
- What would you change if only the browser pages needed the headers?
- How would a test prove that /up now carries the headers?
From the lesson How Laravel handles a request
Model answer, Pro. Model answers open with any pass; prices are in the notice on this page.
Opening the model answers with your pass…
Model answers open with any MySmartCoPilot pass.
Pro pass · 1 week₹79$2.99
30 days₹179$5.99
1 year₹1,699$45
One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.
Passes can’t be bought right now, so the model answers can’t be opened at the moment. If you have a pass, enter your licence key.
Choose a pass I have a licence key
It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

Each page request writes two audit lines, and each JSON request writes one. The audit middleware is registered once in the code you wrote. Find the cause, fix it, and describe the check that keeps it fixed.
What it tests

Reading the kernel's global list and a route's middleware together, finding a class that sits in two layers, and turning the finding into a test.

First step

Print what actually wraps a page route and a JSON route, instead of trusting the file you edited. The list of the kernel and the groups tells you where a class appears.
Follow-ups
- Where else could the class have been added without anyone noticing?
- Would moving the class out of the group change the order of the after lines?
- What would the test assert, and against which request?
From the lesson How Laravel handles a request
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Fresher to mid

After a refactor the "new batch" form at /batches/new shows a page titled "Batch new", and no error is logged. Explain how a routing change can cause this, how you would confirm it, and how you would fix it so it cannot come back.
What it tests

Knowing that routes match in declaration order, that a pattern can capture a fixed word, and how to prove the cause with route:list and a request.

First step

Ask which route answered, not which code is wrong. Print the routes in order and look for a pattern that sits above the fixed path and accepts any word.
Follow-ups
- Why does Laravel not pick the fixed path because it is more specific?
- Which two changes fix it, and which is more robust?
- What test would have caught it?
From the lesson Routing, route parameters and URL generation
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Fresher to mid

Pathshala emails each parent a link to a fee receipt that opens without a login. Design the link so a parent cannot read another family's receipt by changing the number, and say what your design still does not stop.
What it tests

Choosing signed URLs for public routes, setting an expiry, and being honest that a signature proves integrity and not identity.

First step

Say what can go wrong with a plain link, a guessed number, and what has to be true of the link instead: it cannot be edited and it should not live forever.
Follow-ups
- What does the signed middleware answer for an edited link, and for an expired one?
- Who can still use the intact link, and what would you add if the receipt is private?
- Why does the signature depend on the application key?
From the lesson Routing, route parameters and URL generation
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

A deploy script runs php artisan route:cache and the release stops with a LogicException about a route name, although the site worked in staging. Find the cause, fix it, and describe what you would add to the pipeline.
What it tests

Understanding what route caching checks, why the running app hid the clash, and how to catch it before a release.

First step

Read the exception: it names the second route and the name already taken. List the routes and filter by that name to see both.
Follow-ups
- Why does the app work without the cache when two routes share a name?
- What other deploy-time change can make a new route invisible?
- Where in the pipeline would you run route:cache so that the failure appears early?
From the lesson Routing, route parameters and URL generation
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Fresher to mid

On the morning of a mock test, parents report that the sign-in code never arrives, and the log shows a stream of 429 answers from the OTP route. Everyone was on the school's wifi. Find the cause in the limiter, redesign it, and say how you would test the new design.
What it tests

Understanding that a limiter key defines who shares a counter, choosing keys that separate users without letting a caller pick their own key, and testing both sides.

First step

Look at what the limiter uses as its key. If it is the IP address, every family on the wifi is one caller. Then list who the limit is meant to protect: the SMS budget, one phone number, or the whole route.
Follow-ups
- Why is a limit on the phone number alone not enough?
- What changes behind a load balancer, and what setting does it need?
- What would your test assert for two phones on one address?
From the lesson Middleware and rate limiting
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Fresher to mid

A security scan reports that the home page has an X-Frame-Options header but the 404 page and the health check do not. The header comes from a middleware your team wrote. Explain how that can happen and how you would fix it and keep it fixed.
What it tests

Knowing which requests a group, a route and the global list each cover, and writing a test over several kinds of response.

First step

Find out where the middleware is registered. Then ask which requests that place covers and which it never sees.
Follow-ups
- Why does a request for an unknown URL never reach a route middleware?
- How would you write the test so it fails today?
- Which header from your set should not be global, and why?
From the lesson Middleware and rate limiting
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

A maintenance-hours middleware was added to the global list and now it blocks a payment webhook that must always be reachable. Someone suggests withoutMiddleware on the webhook route. Say whether that works, and propose a design that does.
What it tests

Knowing that withoutMiddleware does not remove global middleware, and moving a rule to the layer that fits its scope.

First step

Check what withoutMiddleware can remove, then decide which requests the rule really belongs to. If it has exceptions, global is the wrong layer.
Follow-ups
- What does the route:list output show that would have warned you?
- How would you keep the rule for every other route without repeating it?
- How could a test make sure the webhook stays reachable at night?
From the lesson Middleware and rate limiting
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Fresher to mid

Pathshala's staff pages use /centres/{centre}/batches/{batch}/students/{student:roll_no}. A tester opens /centres/1/batches/7/students/2 and sees a batch of centre 2 under centre 1, though a wrong roll number gives 404. Explain why only part of the URL is scoped, then prove the bug in a test and fix the route.
What it tests

Knowing that a custom key scopes only its own parameter, writing a test with a mismatched pair at each level, and turning scoping on for a whole group of routes.

First step

Write down what limits each of the three lookups. Only {student:roll_no} has a custom key, so start from what that key does, then ask what, if anything, limits {batch}.
Follow-ups
- Why does the custom key on the student leave the batch unscoped?
- What must exist on the Centre and Batch models once scoping covers the whole URL?
- Is a URL whose parts belong together enough to let a member of staff of centre 1 open it?
From the lesson Controllers and route model binding
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Fresher to mid

The counter's pay controller holds the whole rule: refuse a paid instalment, set paid_at, build the receipt. A nightly command must now mark 1,000 bank-confirmed instalments paid and skip those already paid at the counter, while a cashier may press Pay for one of them at the same moment. Restructure the code, and stop a double payment.
What it tests

Moving a rule into a class that two entry points share, handling a refused item inside a loop, and finding and closing a race between a check and a write.

First step

Separate the rule from both callers first: one class decides whether an instalment can be paid and records it. Then look at the rule itself and ask what happens when two callers run it for the same instalment at once.
Follow-ups
- What does the command do when the rule refuses one instalment?
- Why does checking paid_at before the update not stop a double payment?
- What would you test on the action, on the command and on the route?
From the lesson Controllers and route model binding
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
Mid to senior

Staff need to open and restore archived students. A teammate adds ->withTrashed() to Route::resource('students', StudentController::class), whose actions type-hint Student. Say which of the seven routes now reach archived students, what that exposes, and how you would build the archive and the restore instead.
What it tests

Knowing what withTrashed does on a resource registration, seeing which routes it opens beyond the one that was meant, and building a narrow restore route with its own access check.

First step

List the seven resource routes and mark the ones that bind one student from the URL. Only those can change with withTrashed. Then ask which of them the teammate meant to open, and which came along.
Follow-ups
- How would you limit withTrashed to the routes that need it?
- Why should restoring be a POST and not a link?
- Which tests prove that the public pages still hide an archived student?
From the lesson Controllers and route model binding
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Fresher to mid

A staff member opens /students?status=refunded&joined_from=05/01/2026 and sees either the full student list or a server error, depending on the day. Explain what each typed reader does with these values and design the filter so that bad input gets a clear answer.
What it tests

Knowing how enum, integer and date react to bad values, telling an absent key from a bad one, and choosing 422 over silent fallbacks.

First step

Take each query value alone and ask what its reader returns when the text is wrong: a value in its type, null, or an exception. Then decide which of those you can live with.
Follow-ups
- Why is null from enum() not enough to tell a missing key from a bad one?
- What does the exclamation mark in a date format change?
- Where would you put these checks so that every filter page shares them?
From the lesson Requests, input and uploaded files
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Fresher to mid

After the move to a load balancer, the access log shows one address for all visitors and the login limiter locks out whole classrooms. A colleague proposes trusting every proxy to fix it. Evaluate that and propose what you would set.
What it tests

Understanding forwarded headers, trusting a named proxy, the danger of trusting every caller, and checking the setting with a request.

First step

Say where the logged address comes from and why it is the balancer's. Then ask who can reach the application without passing through the balancer.
Follow-ups
- What can a caller do if the application trusts every proxy and is reachable directly?
- How would you test that a forged header is ignored?
- What else in the application reads the address and is affected?
From the lesson Requests, input and uploaded files
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

A receipt upload checks that getClientMimeType() starts with image/ and stores the file under its original name. A colleague rejects it. Say what is wrong, what you would read instead, and how you would store the file.
What it tests

Telling client claims from server facts on an uploaded file, and choosing generated names and content-based checks.

First step

List which values on the object come from the sender and which from the server's own look at the bytes. Then see which of them the code used.
Follow-ups
- Why is checking the extension also weak?
- What does the stored name need to be?
- What test would show the weak check accepting a bad file?
From the lesson Requests, input and uploaded files
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Fresher to mid

A teacher saves a notice, sees the green message once, and then presses the browser's back button and forward again. The message is gone and she thinks the save failed. Explain what happened and what you would change.
What it tests

Knowing the lifetime of flash data, the redirect-after-post pattern, and when a flash is the wrong tool.

First step

Ask which request carried the message and which requests came after. Then decide whether the message is a one-time notice or a fact that should still be on the page.
Follow-ups
- What would reflash or keep change, and what would they not fix?
- Where would you show a fact that must not disappear, such as the saved notice itself?
- Two tabs save notices at nearly the same moment. Can one tab show the other tab's message?
From the lesson Responses, redirects, sessions and cookies
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

Pathshala moves fee payments to pay.pathshala.example, while the notice board stays on www.pathshala.example. Parents must stay signed in when they move between the two. Which session settings change, what does each change put at risk, and how would you check the result before release?
What it tests

Knowing how the cookie Domain attribute widens where a cookie goes, why SameSite does not separate subdomains, and what a shared session costs.

First step

List every host under pathshala.example and who runs it. Then decide which of them should ever receive the session cookie.
Follow-ups
- Does SameSite=Lax stop the session cookie going from the notice board to the fee site?
- Which cookie name prefix can a shared session cookie no longer use?
- What could a less trusted subdomain, such as one that serves uploaded files, do with the shared cookie?
From the lesson Responses, redirects, sessions and cookies
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
Mid to senior

The monthly fee export builds a CSV string of 300,000 rows in a controller and the request ends with a memory error. Redesign the response, and say what the new design still costs the server.
What it tests

Using streamed downloads, chunked queries and the right headers, and being honest about worker time.

First step

Find where the memory goes: the rows, the string, or both. Then decide how the rows can be written to the output as they are read.
Follow-ups
- Why page the rows with chunkById() or lazyById() rather than chunk()?
- What happens to the request when the client disconnects half way?
- When would you move the export to a queued job instead?
From the lesson Responses, redirects, sessions and cookies
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes

The lessons of this module

How Laravel handles a request Free lesson, Pro answers: 15 minutes
Routing, route parameters and URL generation Free lesson, Pro answers: 15 minutes
Middleware and rate limiting Free lesson, Pro answers: 10 minutes
Controllers and route model binding Free lesson, Pro answers: 15 minutes
Requests, input and uploaded files Free lesson, Pro answers: 10 minutes
Responses, redirects, sessions and cookies Free lesson, Pro answers: 15 minutes

All Building Web Apps with Laravel interview questions · The Building Web Apps with Laravel track

Warm-up questions

In which order do the register and boot methods of service providers run, and why does the order matter?

What is the difference between a 404 and a 405 from the router?

What is the difference between work done before $next($request) and work done after it in a middleware?

What does route model binding do, and when does it answer 404?

What do TrimStrings and ConvertEmptyStringsToNull do to input, and what does that mean for validation?

What is flash data, and how long does it live?

Questions with model answers

A teammate adds a SecurityHeaders middleware to the web group. The monitoring check on /up and the JSON routes under /api come back without the headers. Explain why, and say where you would register it instead.

Each page request writes two audit lines, and each JSON request writes one. The audit middleware is registered once in the code you wrote. Find the cause, fix it, and describe the check that keeps it fixed.

After a refactor the "new batch" form at /batches/new shows a page titled "Batch new", and no error is logged. Explain how a routing change can cause this, how you would confirm it, and how you would fix it so it cannot come back.

Pathshala emails each parent a link to a fee receipt that opens without a login. Design the link so a parent cannot read another family's receipt by changing the number, and say what your design still does not stop.

A deploy script runs php artisan route:cache and the release stops with a LogicException about a route name, although the site worked in staging. Find the cause, fix it, and describe what you would add to the pipeline.

On the morning of a mock test, parents report that the sign-in code never arrives, and the log shows a stream of 429 answers from the OTP route. Everyone was on the school's wifi. Find the cause in the limiter, redesign it, and say how you would test the new design.

A security scan reports that the home page has an X-Frame-Options header but the 404 page and the health check do not. The header comes from a middleware your team wrote. Explain how that can happen and how you would fix it and keep it fixed.

A maintenance-hours middleware was added to the global list and now it blocks a payment webhook that must always be reachable. Someone suggests withoutMiddleware on the webhook route. Say whether that works, and propose a design that does.

A staff member opens /students?status=refunded&joined_from=05/01/2026 and sees either the full student list or a server error, depending on the day. Explain what each typed reader does with these values and design the filter so that bad input gets a clear answer.

After the move to a load balancer, the access log shows one address for all visitors and the login limiter locks out whole classrooms. A colleague proposes trusting every proxy to fix it. Evaluate that and propose what you would set.

A receipt upload checks that getClientMimeType() starts with image/ and stores the file under its original name. A colleague rejects it. Say what is wrong, what you would read instead, and how you would store the file.

A teacher saves a notice, sees the green message once, and then presses the browser's back button and forward again. The message is gone and she thinks the save failed. Explain what happened and what you would change.

Pathshala moves fee payments to pay.pathshala.example, while the notice board stays on www.pathshala.example. Parents must stay signed in when they move between the two. Which session settings change, what does each change put at risk, and how would you check the result before release?

The monthly fee export builds a CSV string of 300,000 rows in a controller and the request ends with a memory error. Redesign the response, and say what the new design still costs the server.