All middlewares

Every middleware type Miabi curates. Each has a form in the console, validation on save, and encryption for any field holding a credential. See Using middlewares for how to attach them to a route and why the order matters.

Access

Middleware	Type	What it does
Basic authentication	basicAuth	Require a username and password (HTTP Basic) to reach the route.
JWT authentication	jwtAuth	Require a valid JSON Web Token. Verify with a shared secret (HS*), a public key, or a JWKS endpoint.
OpenID Connect (SSO)	oidc	Sign users in at the gateway against an identity provider, and pass who they are to the app.
Forward authentication	forwardAuth	Delegate authentication to an external service, like Authelia or oauth2-proxy.
LDAP authentication	ldapAuth	Authenticate users against an LDAP / Active Directory directory.

Security

Middleware	Type	What it does
Block access	access	Deny requests to the matched paths with a fixed status code.
IP access policy	accessPolicy	Allow or deny requests by client IP / CIDR range.
Request body limit	bodyLimit	Reject requests whose body exceeds a size limit.
Block user agents	userAgentBlock	Reject requests whose User-Agent matches any of the listed patterns.
Country access policy (GeoIP)	geoBlock	Allow or deny requests by client country (GeoIP), with optional country-header enrichment for the backend.

Traffic

Middleware	Type	What it does
Rate limit	rateLimit	Throttle requests per client over a time unit.
HTTP cache	httpCache	Cache responses at the gateway so repeat requests never reach the app.

Transform

Middleware	Type	What it does
Force scheme (HTTPS)	redirectScheme	Redirect requests to a different scheme — typically http→https.
Redirect	redirect	Redirect every matched request to a fixed URL.
Redirect (regex)	redirectRegex	Redirect using a regular-expression match on the request path.
Rewrite path (regex)	rewriteRegex	Rewrite the request path with a regular expression before it reaches the app.
Add path prefix	addPrefix	Prepend a path prefix before forwarding the request to the app.
Request headers	requestHeaders	Add, override or remove headers before the request reaches the app.
Response headers	responseHeaders	Add, override or remove headers on the response, and set CORS or cookies.

Observability

Middleware	Type	What it does
Error interceptor	errorInterceptor	Replace upstream error responses with a custom body or template.

Uncatalogued types

A middleware type Miabi does not curate can still be used: the rule is passed to the gateway as written. It gets no form, no validation and no encryption of its fields, so a credential in one is stored in the clear. Prefer a curated type where one exists.