A Traefik middleware acts on a request or its response between the router and the service. It can adjust a path, trigger an HTTP redirect, add headers or compress content. This lesson is for people publishing a service who need to choose the right transformation, understand execution order and diagnose unexpected behavior. Protection mechanisms such as authentication, IP filtering and rate limiting are covered in Protecting the Traefik entry point.
What you will learn
These objectives help you choose a transformation based on its effect on the client, backend and HTTP response.
- Locate a middleware in Traefik request processing.
- Distinguish a path rewrite from a client redirect.
- Explain the effect of response headers and compression.
- Reason about the order and reuse of a middleware chain.
- Diagnose a missing middleware, an incorrect attachment or the wrong order.
Prerequisites
This lesson assumes that you know Traefik's main objects: entrypoint, router and service. The router selects a route, and the service represents the backend that receives the request. If these roles are new, start with Traefik concepts. It is also useful to know how to read an HTTP response and recognize its status code.
What does a middleware do while a request is processed?
A middleware is an intermediate step between the router that matches a request and the service that forwards it to the backend. It can change parts of the request before it arrives, or act on the response on its way back to the client. This lets you apply a rule once at the entry point instead of copying it into every application. The diagram shows the components and their general order without depending on a configuration provider.
The router decides where to send the request; a middleware does not replace that decision. If no router matches, a middleware attached to a different route cannot fix the selection. This distinction helps separate a routing problem from a transformation that is not being applied.
When should you rewrite a path instead of redirecting the client?
A rewrite changes the path sent to the backend without asking the client to repeat its request. The URL displayed by the browser stays the same. Use it when the service expects a different path structure from the one you want to publish. Common options remove or add a prefix, or replace the entire path. Before choosing, check the backend's expected path and any absolute links in its responses.
A redirect returns an HTTP status and a new address to the client. The client then sends another request, and the visible address changes. Use it to move a URL, enforce a canonical address or signal that a resource has moved. The choice between rewriting and redirecting depends on the intended result: adapt the backend or inform the client. A redirect is not a transparent way to change the path received by the application.
| Need | Mechanism | Visible effect |
|---|---|---|
| Adapt the path sent to the application | Rewrite | The client's URL stays the same |
| Tell the client about a new address | Redirect | The client receives a status and another URL |
| Change only part of the path | Remove or add a prefix | The rest of the path is preserved |
| Replace the path with a fixed destination | Replace | The original path is no longer forwarded as-is |
What changes when you issue an HTTP redirect?
A redirect is an HTTP response asking the client to use another URL. A temporary status is suitable if the move may be reversed; a permanent status indicates a lasting change. Browsers and caches can remember a permanent redirect, making a rollback less straightforward. Choose the status based on how long the change will really last, and check the behavior with a client that does not automatically follow the new address.
A redirect can change the scheme, host or path. Avoid replacing a simple rule with a complex regular expression: each capture group increases the risk of an incorrect destination. Also check for loops, such as when a proxy and backend repeatedly redirect each other to an insecure URL. The key is to know which component sends the response and which URL the client will actually follow.
What are response headers for?
HTTP headers carry metadata with a response, such as its content type or rules for the browser. Traefik can add security headers to a response, but their values depend on the application and publication context. A header does not replace a complete security policy: a poorly adapted browser rule can block legitimate resources or create a false sense of protection.
Before adding a rule, check whether the backend already sends the same header. Conflicting values or duplicates make diagnosis harder and may be interpreted differently by clients. Test HTTP responses in a representative environment, then check the effect in the browser and with HTTP analysis tools. Dashboard protection, authentication and access restrictions belong in the lesson on Traefik security.
What does response compression negotiate?
HTTP compression reduces the size of some text content sent over the network. The client advertises the formats it can decode, then the server chooses a compatible format or sends the content without compression. Already-compressed content usually gains little from being compressed again. Consider response size and type, CPU load and latency before enabling this feature.
Compression must also be evaluated against the type of traffic. A large response may benefit from a shorter transfer, while compressing a small response may cost more than it saves. Compression can add latency; measure its effect on streams that require immediate delivery. Compare the response with and without compression negotiation, then check that the client still receives content it can decode.
How should you chain multiple middlewares?
A chain groups middlewares so they can be attached together to a router or reused across services. It reduces repeated configuration, but does not make the steps interchangeable. Order matters when two middlewares change the same element or when one step depends on the previous result. Reason about the request path and then the response path, and use names that make each step's role clear.
Keep a chain short and coherent. The backend must understand path transformations; headers must match the published response; compression must not harm a stream that requires immediate delivery. Do not add a protection or authentication rule here just for convenience: its scope and checks are covered in the Traefik protection lesson. After every change, verify the end-to-end result rather than relying on the configuration being present.
How do you diagnose a middleware that does not apply?
Start by confirming that the expected router receives the request. A different router, a non-matching rule or another provider may explain why a middleware appears to be ignored. Then check that the resource name is correct and that the router references the middleware in the same configuration namespace. A missing resource often produces a warning in Traefik's logs.
Finally, compare the request from the client, the path received by the backend and the returned response. If the path did not change, the rewrite may not be attached or may target another router. If the client receives a different URL, that is a redirect, not a rewrite. If the expected headers or encoding are missing, inspect the response actually sent by the application and the chain applied by Traefik. Testing after each change helps isolate the faulty step.
Practice
The lab asks you to chain middlewares for a path transformation, handle an old URL and adjust a response. It provides its own environment and success criteria; this lesson explains the concepts without giving you the expected configuration.
Key points
These rules help you predict where a transformation acts before combining it with other steps.
- A rewrite changes the request sent to the backend without changing the client's URL.
- A redirect is an HTTP response the client follows to another URL.
- Headers change response metadata; compression depends on the client and content.
- A chain's order can change the result; verify behavior end to end.
Knowledge check
The quiz checks that you can distinguish transformations and their effects.
Knowledge check
Check what you have learned with this interactive quiz
How it works
- The timer starts when you click Start
- Multiple choice, true/false and short answer questions
- You can move between questions
- Detailed results are shown at the end
Starts the quiz and the timer
Review
(0/0)Score by domain
A domain groups several guides and gets several questions, so its score is more reliable than a per-topic score, which often rests on a single question.
Summary
Strengths
No topic passed at 80% on at least two questions yet.
Weak areas
No topic below the pass mark.
Recommended next
Hints before you try again?
Continue the course: Control health checks, timeouts and long-lived streams with Traefik
A new full quiz with random questions
Work again only on the questions you missed