Where should authentication, authorisation, validation and error formatting live in a web framework?

Summary

Authentication in the pipeline layer that runs for every request (middleware, firewall, guard, filter, dependency); coarse authorisation in route-level middleware, guards or dependencies with default-deny; resource-level authorisation near the data (services, policies, query scopes); validation at the input boundary (Form Requests, serializers, Pydantic models, pipes, @Valid); error formatting in one global handler (exception handler, kernel.exception, exception filters, @ControllerAdvice).

Longer Answer

Putting checks inside each controller by hand makes them opt-in, and one forgotten endpoint becomes a data leak. A route-inventory test that fails when a route has no authorisation rule enforces default-deny.

Key Points

• Authentication in the global pipeline.
• Default-deny coarse authorisation.
• Resource checks near the data.
• One global error formatter.

Deep dive: Request Lifecycle: Choosing the Right Layer for Cross-Cutting Concerns

What interviewers look for

Layer-appropriate placement and the default-deny principle.