Middleware vs Dispatcher Filter Execution Order in CakePHP 4.x/5.x

Problem

When upgrading from CakePHP 3.x to 4.x or 5.x, legacy dispatcher filters wrapped by the compatibility layer run after the PSR‑15 middleware stack. This reversal causes request and response mutations from filters to be applied in the opposite order of the original 3.x behaviour, potentially altering header values and timing of events such as Controller.beforeRender and Controller.beforeRedirect.

Goal

Assess whether the altered execution order is acceptable for existing plugins or if custom dispatcher filters must be rewritten as native middleware to preserve original semantics.

Constraints

The compatibility layer remains unchanged across 4.x and 5.x, but PHP runtime differences and third‑party plugins that rely on precise event ordering may fail silently. Full request‑cycle testing is required to detect subtle regressions.

Unresolved Questions

• Does the reversed execution order affect the semantics of authentication or CORS filters in a way that cannot be mitigated by simple header ordering?
• Can the event dispatching for beforeRender and beforeRedirect be adjusted within the compatibility layer to match the 3.x timing without rewriting filters?
• What migration strategy offers the least risk for long‑term maintenance when moving from dispatcher filters to PSR‑15 middleware?