Middleware

Middleware model comparison

Express middleware is (req, res, next) => void. You call next() to pass control to the next layer, or call res.json() to short-circuit. Echo middleware follows the same pipeline idea but uses Go’s error-return pattern and closures:

// Echo middleware signature
func(next echo.HandlerFunc) echo.HandlerFunc

A middleware returns a new HandlerFunc that wraps next. Call next(c) to pass control forward, or return an error to abort.

// Express middleware
function requestLogger(req, res, next) {
  console.log(`${req.method} ${req.path}`);
  next();
}
app.use(requestLogger);

// Echo middleware
func RequestLogger(next echo.HandlerFunc) echo.HandlerFunc {
    return func(c echo.Context) error {
        fmt.Printf("%s %s\n", c.Request().Method, c.Request().URL.Path)
        return next(c)   // pass control forward
    }
}

e.Use(RequestLogger)

Built-in middleware

Echo ships several production-ready middlewares in the middleware sub-package.

// Express with popular packages
import morgan from 'morgan';
import cors from 'cors';

app.use(morgan('combined'));
app.use(cors({ origin: '*' }));
// No built-in recover — need express-async-errors or similar

// Echo built-ins — no extra packages needed
import "github.com/labstack/echo/v4/middleware"

e.Use(middleware.Logger())   // structured request log to stdout
e.Use(middleware.Recover())  // catches panics, returns 500
e.Use(middleware.CORS())     // default: allows all origins

// Restrict CORS to specific origins:
e.Use(middleware.CORSWithConfig(middleware.CORSConfig{
    AllowOrigins: []string{"https://example.com"},
    AllowMethods: []string{http.MethodGet, http.MethodPost},
}))

Middleware ordering

Just like Express, order matters. Middleware registered first runs first. Logger and Recover should always be outermost so they see every request and catch every panic.

e.Use(middleware.Logger())   // 1st — log all requests
e.Use(middleware.Recover())  // 2nd — catch panics from any later handler
e.Use(authMiddleware)        // 3rd — auth checks after logging is set up

Route-level and group-level middleware

In Express you pass middleware directly to a route. Echo supports the same with .Use on a group.

// Express — per-route middleware
app.get('/admin', authMiddleware, adminHandler);

// Express — router-level
const adminRouter = express.Router();
adminRouter.use(authMiddleware);
adminRouter.get('/', adminHandler);
app.use('/admin', adminRouter);

// Echo — per-route middleware
e.GET("/admin", adminHandler, authMiddleware)

// Echo — group-level middleware
admin := e.Group("/admin")
admin.Use(authMiddleware)
admin.GET("", adminHandler)
admin.GET("/users", adminUsersHandler)

Writing a custom auth middleware

// Express JWT-like auth middleware
function requireAuth(req, res, next) {
  const token = req.headers.authorization?.split(' ')[1];
  if (!token) return res.status(401).json({ message: 'unauthorized' });
  try {
    req.user = verifyToken(token);
    next();
  } catch {
    res.status(401).json({ message: 'invalid token' });
  }
}

// Echo custom auth middleware
func RequireAuth(next echo.HandlerFunc) echo.HandlerFunc {
    return func(c echo.Context) error {
        header := c.Request().Header.Get("Authorization")
        if header == "" {
            return echo.NewHTTPError(http.StatusUnauthorized, "missing token")
        }
        parts := strings.SplitN(header, " ", 2)
        if len(parts) != 2 || parts[0] != "Bearer" {
            return echo.NewHTTPError(http.StatusUnauthorized, "bad token format")
        }
        claims, err := verifyToken(parts[1])
        if err != nil {
            return echo.NewHTTPError(http.StatusUnauthorized, "invalid token")
        }
        // Store claims in context for downstream handlers
        c.Set("user", claims)
        return next(c)
    }
}

🟦 Storing values in context

c.Set(key, value) stores an arbitrary value in the request-scoped context. Retrieve it with c.Get(key). This is equivalent to req.user = claims in Express but type-safe with an explicit cast:

claims := c.Get("user").(*MyClaims)

Use typed keys (a local type contextKey string) to avoid collisions in larger codebases.

Run this locally — it needs the Echo module and a network port.