Middleware handles cross-cutting concerns: authentication, logging, CORS, rate limiting, request validation. In Express, Laravel, and Django it's a first-class concept. Use middleware for anything applying to many routes; don't stuff business logic into middleware — it becomes hard to test.