I stopped trusting middleware for everything (almost)

Not because middleware is bad. But because I was using it for things it was never meant to guarantee. The pattern we all write app . use ( authMiddleware ) app . get ( " /me " , ( c ) => { return c . json ( c . get ( " user " )) }) This works. It’s simple. It’s familiar. But it relies on an assumption: “ user will be there when I need it.” And nothing actually enforces that. Where things break A few very normal mistakes: You forget to apply middleware to a route You register it in the wrong order You refactor something and break the chain Everything still compiles. The app still runs. The failure shows up later — usually when it matters. Middleware isn’t the problem Frameworks like Hono and Elysia do middleware really well: Hono keeps things minimal and close to Web standards Elysia pushes type safety further than most frameworks And middleware itself is great for: logging compression request/response transformations That’s exactly what it’s designed for. The real issue The problem is