Laravel routes are defined in routes/web.php for browser traffic or routes/api.php for stateless APIs. A route can return a view directly via a closure or point to a controller action such as Route::get('/users', [UserController::class, 'index']). Laravel maps each HTTP verb to a router method: get for reads, post for creates, put or patch for updates, and delete for deletes, with any matching everything and match accepting a subset. For CRUD-heavy resources, Route::resource() registers seven standard routes (index, create, store, show, edit, update, destroy) automatically; for APIs, Route::apiResource() excludes the form-only create and edit verbs. Routes can capture URI segments as parameters, marked required or optional, and constrained with where('id', '[0-9]+') for regex validation.
Named routes let you reference URLs symbolically so the actual paths can change without breaking callers. Naming a route with ->name('dashboard') lets you generate URLs via route('dashboard') and redirect via return redirect()->route('dashboard'). Route groups share common attributes such as prefix, middleware, name, domain, and where, which keeps related route declarations DRY. Laravel also supports signed URLs (with a hash Laravel validates to prevent tampering), rate limiting via the throttle middleware, and named limiters configured through RateLimiter::for(...) in a service provider. Additional routes can be added alongside a resource controller by placing them before the resource registration, since more specific routes win during matching.
Route model binding eliminates boilerplate by injecting model instances directly into controllers. With implicit binding, a type-hinted parameter like Post \(post is resolved by primary key automatically; if no record matches, Laravel throws a 404. Explicit binding (Route::bind('post', fn(\)v) => Post::where('slug', $v)->firstOrFail())) is useful for slug-based lookups, and overriding resolveRouteBinding() on the model itself provides per-model customization. In Laravel 11+, scoped bindings via Route::scopeBindings() or resolveRouteBindingQueryUsing() constrain child lookups to the parent resource, which is critical for multi-tenant applications where posts must belong to the requested user.
Middleware filters HTTP requests before or after they reach your application, handling cross-cutting concerns such as authentication, CORS, and logging. Create custom middleware with php artisan make:middleware CheckAge and implement logic in handle(); register it in bootstrap/app.php on Laravel 11+ or in app/Http/Kernel.php on older versions, either globally (runs on every request) or on specific routes via ->middleware('auth'). Middleware parameters are passed after a colon ('role:editor,admin') and received as variadic arguments in handle(). The optional terminate() method runs after the response is sent and is useful for logging, but should never hold critical security logic since the response is already on the wire.