I stopped treating controller middleware as the outer edge of a Laravel app after I mapped what actually happens to an HTTP request. Form Requests, CSRF tokens, authentication, policies, and the query builder all run after PHP has already accepted the connection. A web application firewall is a different layer. SafeLine is a self-hosted WAF that filters and monitors HTTP traffic between a web application and the Internet. Deployed in front of the app, it is a reverse proxy: clients pass through it before they reach the origin, and it blocks malicious HTTP and HTTPS traffic while also aiming to prevent unauthorized data from leaving the app ( https://docs.waf.chaitin.com/en/home ). The application guide describes the same flow.…