middleware

Define request middleware for authentication, logging, and context in @rangojs/router applications.

Updated Nov 7, 2025
One-click install
npx skills add https://github.com/rangojs/rango --skill middleware-rangojs
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: middleware
Source: https://github.com/rangojs/rango/tree/main/packages/rangojs-router/skills/middleware
Command: npx skills add https://github.com/rangojs/rango --skill middleware-rangojs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? It provides a structured way to run shared logic before and after route handlers in a Rango router, so authentication, logging, rate limiting, and request context setup do not have to be duplicated inside every route handler. ## Core Features & Use Cases - Two execution scopes: Register global middleware with router.use() to wrap entire requests including server actions, or route middleware with middleware() inside urls() to wrap rendering only. - Typed context sharing: Pass data from middleware to handlers using ctx.set/ctx.get with createVar<T>() or Rango.Vars augmentation for type-safe request state. - Common patterns included: Ready-made examples for auth guards, permission checks, request logging, KV-backed rate limiting, redirects with flash state, and build-time PPR shell middleware. - Use Case: Protect an /admin section by registering router.use("/admin/*", requireAuth) so both page renders and server actions are gated, while a route-level middleware sets per-render context variables. ## Quick Start Add an authentication middleware to my Rango router that protects all routes under /admin and redirects unauthenticated users to /login.

Frequently Asked Questions about middleware

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add authentication middleware to Rango router routes?

Register global middleware with router.use("/admin/*", requireAuth) to protect both rendering and server actions, or use middleware(authMw) inside urls() for render-only scoping. Throw a 401 Response or return redirect("/login") when the user is not authenticated.

What is the difference between global and route middleware in Rango?

Global middleware registered with router.use() wraps the entire request including server actions and progressive enhancement re-renders. Route middleware declared inside urls() wraps rendering only and does not guard server action execution.

Can route middleware protect server actions in Rango?

No, route middleware cannot guard server actions because actions execute before route middleware runs. Use pattern-scoped global middleware like router.use("/admin/*", requireAuth) or check authorization inside the action body itself.

How do I share typed data between middleware and handlers?

Use createVar<T>() to define a typed variable, set it in middleware with ctx.set(CurrentUser, user), and read it in handlers with ctx.get(CurrentUser). Alternatively use string keys with global typing via Rango.Vars augmentation.

Does middleware run during prerendering in Rango?

Plain Prerender does not run middleware since there is no request. The exception is Prerender with ppr build-shell capture, where middleware replays with ctx.build === true and ctx.dynamic() can opt a URL out of the baked shell.