Configuring Middleware

Overview

Middleware functions in Hono intercept incoming HTTP requests and outgoing responses. They allow you to attach cross-cutting features—such as security headers, CORS protection, JWT or bearer authentication, body payload limits, and request logging—globally or to specific route patterns.

This guide covers how to set up and configure these standard middleware utilities using Hono's public API.

Security Headers (secureHeaders)

Introduction to Secure Headers

The secure headers middleware adds standard HTTP security headers (such as Content Security Policy, X-Frame-Options, and Strict-Transport-Security) to your responses and removes exposing headers like X-Powered-By.

Usage Example

Copyimport { Hono } from 'hono'
import { secureHeaders } from 'hono/secure-headers'
 
const app = new Hono()
 
// Apply default secure headers globally
app.use(secureHeaders())
 
app.get('/', (c) => c.text('Protected by secure headers!'))

Cross-Origin Resource Sharing (cors)

Introduction to CORS

The CORS middleware manages response headers to control how browser applications from different domains can access your resources.

Usage Example

Copyimport { Hono } from 'hono'
import { cors } from 'hono/cors'
 
const app = new Hono()
 
// Allow specific origins and configure credentials
app.use(
  '/api/*',
  cors({
    origin: 'http://example.com',
    allowHeaders: ['X-Custom-Header', 'Upgrade-Insecure-Requests'],
    allowMethods: ['POST', 'GET', 'OPTIONS'],
    exposeHeaders: ['Content-Length', 'X-Kuma-Revision'],
    maxAge: 600,
    credentials: true,
  })
)

Authentication Middleware

Introduction to Authentication

Hono provides multiple built-in mechanisms to secure your routes via token verification.

JWT Authentication (jwt)

The JWT middleware validates JSON Web Tokens passed via the Authorization header or cookies.

Copyimport { Hono } from 'hono'
import { jwt } from 'hono/jwt'
 
const app = new Hono()
 
app.use(
  '/auth/*',
  jwt({
    secret: 'it-is-very-secret',
    alg: 'HS256',
  })
)
 
app.get('/auth/page', (c) => {
  const payload = c.get('jwtPayload')
  return c.json({ message: 'Authorized', payload })
})

Supported algorithms for verification in jwt:

• Supported signing algorithms: HS256, HS384, HS512, RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, ES512, EdDSA
• Sources: src/middleware/jwt/jwt.ts

Bearer Token Authentication (bearerAuth)

The bearer auth middleware validates raw bearer tokens against a static string, array of strings, or a custom verification function.

Copyimport { Hono } from 'hono'
import { bearerAuth } from 'hono/bearer-auth'
 
const app = new Hono()
 
app.use('/api/*', bearerAuth({ token: 'my-secret-token' }))
 
app.get('/api/data', (c) => c.text('Access granted'))

JWK Authentication (jwk)

The JWK middleware validates asymmetric JWTs using JSON Web Keys provided directly or fetched via a jwks_uri.

Copyimport { Hono } from 'hono'
import { jwk } from 'hono/jwk'
 
const app = new Hono()
 
app.use(
  '/api/*',
  jwk({
    jwks_uri: 'https://auth.example.com/.well-known/jwks.json',
    alg: ['RS256'],
  })
)

Payload and Request Controls

Body Size Limits (bodyLimit)

The body limit middleware restricts incoming request payload sizes, returning a 413 Payload Too Large status code when exceeded.

Copyimport { Hono } from 'hono'
import { bodyLimit } from 'hono/body-limit'
 
const app = new Hono()
 
app.post(
  '/upload',
  bodyLimit({
    maxSize: 50 * 1024, // 50 KB limit
    onError: (c) => c.text('File is too large!', 413),
  }),
  async (c) => {
    return c.text('Upload successful!')
  }
)

CSRF Protection (csrf)

The CSRF middleware protects your endpoints by validating request origins and Sec-Fetch-Site headers for state-changing HTTP methods.

Copyimport { Hono } from 'hono'
import { csrf } from 'hono/csrf'
 
const app = new Hono()
 
// Require matching origin or same-origin fetch site
app.use('*', csrf())

Logging (logger)

Introduction to Logger

The logger middleware prints incoming requests and outgoing responses (including HTTP status and elapsed execution time) to the console or a custom output function.

Usage Example

Copyimport { Hono } from 'hono'
import { logger } from 'hono/logger'
 
const app = new Hono()
 
// Enable default console logger
app.use(logger())
 
app.get('/', (c) => c.text('Hello Hono!'))

Configuration Reference Summary

Related

• Routing and Handlers
• Errors and Exceptions