A composable request path.

Implement one interface

use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Message\ResponseInterface;

final class Trace implements MiddlewareInterface
{
    public function process(
        ServerRequestInterface $request,
        RequestHandlerInterface $next
    ): ResponseInterface {
        return $next->handle($request)
            ->withHeader('X-Example', 'ICOM');
    }
}

$app->use(new Trace());
$app->get('/hello', $controller)->middleware(new Trace());

Default order

RequestContext assigns a server-generated request ID and adds security headers. Errors renders safe exceptions. RequestGuard checks allowed hosts, target and body size and parses JSON. Throttle limits demo API calls. CsrfProtection protects unsafe browser requests. Routing and route middleware run last. Responses return through the stack in reverse order.

Input and failure behavior

The default body limit is 64 KiB. JSON objects and form-urlencoded bodies are accepted; unsupported media types return 415, malformed JSON returns 400 and oversized input returns 413. Configure equivalent limits at the web server too. File uploads need a dedicated policy and middleware; they are not enabled in this preview demo.

Keep errors private

Production errors return a generic message and request ID. Logs include exception class and source location, excluding exception messages, headers and request bodies. APP_DEBUG is honored only outside production. Configure rotation and access permissions for file logs, or set LOG_PATH=php://stderr in containers.