Go Middleware Best Practices in Production (2026)

Short summary

A veteran Go engineer shares hard-won lessons on middleware ordering in production APIs. The three non-negotiable rules: recover must be outermost, request ID before logger, and auth/rate-limit closest to the handler but after observability. Getting the chain direction wrong causes invisible panics, untraceable 500s, and blind spots for rejected requests.

• •Recover middleware must be the outermost layer to catch all panics including those in other middleware
• •Request ID must precede logger so log lines carry correlation IDs
• •Auth and rate-limit should sit after observability so rejected requests are still logged

Generated with AI, which can make mistakes.