Lumen middleware pipeline execution order in grouped routes

Answer

In Lumen, global middleware registered in bootstrap/app.php runs before route-group middleware. The framework does not provide a built-in priority mechanism to inject group-level middleware ahead of the global stack. The layering is fixed: global middleware executes first, then group middleware, then the route handler.

Confirmed Behavior

• Global middleware is registered with $app->middleware([...]) in bootstrap/app.php and applies to every request.
• Route groups attach middleware via the group options array, for example $app->group(['middleware' => ['auth']], function () { ... });.
• Middleware within each layer runs sequentially in registration order. A middleware that returns a response without calling $next($request) stops the pipeline.
• This ordering is documented for Lumen 8.x and 9.x. Because Lumen is no longer under active feature development, verify the behavior against your exact installed version if you rely on it for security boundaries.

Verification Steps

1. Create a global middleware that tags the response:

   <?php
   namespace App\Http\Middleware;
   
   use Closure;
   
   class GlobalMarker
   {
       public function handle($request, Closure $next)
       {
           $response = $next($request);
           $response->headers->set('X-Global', 'true');
           return $response;
       }
   }

   Register it in bootstrap/app.php:

   $app->middleware([
       App\Http\Middleware\GlobalMarker::class,
   ]);

2. Create a group middleware:

   <?php
   namespace App\Http\Middleware;
   
   use Closure;
   
   class GroupMarker
   {
       public function handle($request, Closure $next)
       {
           $response = $next($request);
           $response->headers->set('X-Group', 'true');
           return $response;
       }
   }

   Define a group:

   $app->group(['prefix' => 'api', 'middleware' => [App\Http\Middleware\GroupMarker::class]], function () {
       $app->get('/test', function () {
           return 'ok';
       });
   });

3. Request /api/test and inspect headers. The global marker should appear before the group marker. If the order differs, check whether a global middleware short-circuits the pipeline.

Missing Diagnostic Detail

Do any of your global middleware conditionally return a response without calling $next($request)? That would prevent group middleware from running and could explain an unexpected sequence.