Hi,
you don't need to "protect" the files in your app, since the web server will only send the requests to the index.php in the public folder. Actually only files in that folder will be somehow accessible to the end-user. All this means that the routing is done via the application and not your web-server. That's where the web.php file comes in to play. There you register the routes you want, e.g.:
// in web.php
Route::get('/products', 'ProductsController@index');
The above example tells your application to call the index method on the ProductsController when a GET request to the uri /products is detected. In fact the application keeps a long list of all the routes you register and checks if the current user request matches any of them. If yes it just does whatever you told it to.
Now to use the middleware you can do this:
// in web.php
Route::get('/products', 'ProductsController@index')->middleware('auth');
Now the application will see that the user wants a page you have registered. But it will also pass the request through a series of middleware classes which will examine the request and either approve or deny it. In this example the auth middleware will check if the user is authenticated and take appropriate action. Just to make it even clearer here's an example chain of what's happening:
GET 'https://site.com/products' -> web-server -> app/public/index.php -> Router (class) -> '/products' GET Route -> Auth Middleware -> ProductsController -> index method -> your code -> return response.
I hope this helps.
