diff --git a/.testcoverage.yml b/.testcoverage.yml
index 372613f..3dc1910 100644
--- a/.testcoverage.yml
+++ b/.testcoverage.yml
@@ -4,4 +4,5 @@ exclude:
     - mocks	# exclude generated mock files
     - ^test/
     - ^logger/testlogger
+    - middleware/test_support
 
diff --git a/jwt/model.go b/jwt/model.go
index d9fc69e..2f5574a 100644
--- a/jwt/model.go
+++ b/jwt/model.go
@@ -33,6 +33,7 @@ type WebToken struct {
 
 // New retrieves a new WebToken from an id_token string provided by OpenID communication
 // When not able to parse or deserialize the requested claims, it will return an error
+// JWT Claims are parsed without verification, ensure properer JWT verification before calling this function, eg. with istio
 func New(idToken string, signatureAlgorithms []jose.SignatureAlgorithm) (webToken WebToken, err error) {
 	token, parseErr := jwt.ParseSigned(idToken, signatureAlgorithms)
 	if parseErr != nil {
diff --git a/middleware/auth.go b/middleware/auth.go
new file mode 100644
index 0000000..1e29136
--- /dev/null
+++ b/middleware/auth.go
@@ -0,0 +1,26 @@
+package middleware
+
+import (
+	"net/http"
+
+	"github.com/go-http-utils/headers"
+
+	appctx "github.com/platform-mesh/golang-commons/context"
+)
+
+// StoreAuthHeader returns HTTP middleware that reads the request's Authorization header and stores it in the request context.
+// The middleware wraps a handler, extracts the Authorization header (using headers.Authorization), calls
+// appctx.AddAuthHeaderToContext with the existing request context and the header value, and invokes the next handler
+// with the request updated to use that context. If the Authorization header is absent or empty, nothing is stored.
+func StoreAuthHeader() func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(responseWriter http.ResponseWriter, request *http.Request) {
+			auth := request.Header.Get(headers.Authorization)
+			ctx := request.Context()
+			if auth != "" {
+				ctx = appctx.AddAuthHeaderToContext(ctx, auth)
+			}
+			next.ServeHTTP(responseWriter, request.WithContext(ctx))
+		})
+	}
+}
diff --git a/middleware/auth_test.go b/middleware/auth_test.go
new file mode 100644
index 0000000..d3ae407
--- /dev/null
+++ b/middleware/auth_test.go
@@ -0,0 +1,101 @@
+package middleware
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/go-http-utils/headers"
+	"github.com/platform-mesh/golang-commons/context"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestStoreAuthHeader_WithAuthHeader(t *testing.T) {
+	expectedAuth := "Bearer token123"
+
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Verify auth header is stored in context
+		authFromContext, err := context.GetAuthHeaderFromContext(r.Context())
+		assert.NoError(t, err)
+		assert.Equal(t, expectedAuth, authFromContext)
+
+		w.WriteHeader(http.StatusOK)
+	})
+
+	middleware := StoreAuthHeader()
+	handlerToTest := middleware(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	req.Header.Set(headers.Authorization, expectedAuth)
+	recorder := httptest.NewRecorder()
+
+	handlerToTest.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+}
+
+func TestStoreAuthHeader_WithoutAuthHeader(t *testing.T) {
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Verify empty auth header returns error when not set
+		_, err := context.GetAuthHeaderFromContext(r.Context())
+		assert.Error(t, err) // Should return error when no auth header is set
+
+		w.WriteHeader(http.StatusOK)
+	})
+
+	middleware := StoreAuthHeader()
+	handlerToTest := middleware(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	// No authorization header set
+	recorder := httptest.NewRecorder()
+
+	handlerToTest.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+}
+
+func TestStoreAuthHeader_WithEmptyAuthHeader(t *testing.T) {
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Verify empty auth header returns error when empty
+		_, err := context.GetAuthHeaderFromContext(r.Context())
+		assert.Error(t, err) // Should return error when auth header is empty
+
+		w.WriteHeader(http.StatusOK)
+	})
+
+	middleware := StoreAuthHeader()
+	handlerToTest := middleware(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	req.Header.Set(headers.Authorization, "")
+	recorder := httptest.NewRecorder()
+
+	handlerToTest.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+}
+
+func TestStoreAuthHeader_MultipleAuthHeaders(t *testing.T) {
+	// Test behavior when multiple authorization headers are present
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Should get the first header value since http.Header.Get returns only the first value
+		authFromContext, err := context.GetAuthHeaderFromContext(r.Context())
+		assert.NoError(t, err)
+		assert.Equal(t, "Bearer token1", authFromContext)
+
+		w.WriteHeader(http.StatusOK)
+	})
+
+	middleware := StoreAuthHeader()
+	handlerToTest := middleware(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	req.Header.Add(headers.Authorization, "Bearer token1")
+	req.Header.Add(headers.Authorization, "Bearer token2")
+	recorder := httptest.NewRecorder()
+
+	handlerToTest.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+}
diff --git a/middleware/authzMiddlewares.go b/middleware/authzMiddlewares.go
new file mode 100644
index 0000000..84a202e
--- /dev/null
+++ b/middleware/authzMiddlewares.go
@@ -0,0 +1,18 @@
+package middleware
+
+import (
+	"net/http"
+)
+
+// Middleware defines a function that wraps an http.Handler.
+type Middleware func(http.Handler) http.Handler
+
+// CreateAuthMiddleware returns a slice of Middleware functions for authentication and authorization.
+// The returned middlewares are: StoreWebToken, StoreAuthHeader, and StoreSpiffeHeader.
+func CreateAuthMiddleware() []Middleware {
+	return []Middleware{
+		StoreWebToken(),
+		StoreAuthHeader(),
+		StoreSpiffeHeader(),
+	}
+}
diff --git a/middleware/authzMiddlewares_test.go b/middleware/authzMiddlewares_test.go
new file mode 100644
index 0000000..f0f3d3a
--- /dev/null
+++ b/middleware/authzMiddlewares_test.go
@@ -0,0 +1,32 @@
+package middleware
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCreateAuthMiddleware(t *testing.T) {
+	middlewares := CreateAuthMiddleware()
+
+	// Expect 3 middlewares: StoreWebToken, StoreAuthHeader, StoreSpiffeHeader
+	assert.Len(t, middlewares, 3)
+
+	// Each middleware should not be nil
+	for _, mw := range middlewares {
+		assert.NotNil(t, mw)
+	}
+}
+
+func TestCreateAuthMiddleware_ReturnsCorrectMiddlewares(t *testing.T) {
+	middlewares := CreateAuthMiddleware()
+
+	// Should return exactly 3 middlewares
+	assert.Len(t, middlewares, 3)
+
+	// Each middleware should be a valid function
+	for _, mw := range middlewares {
+		assert.NotNil(t, mw)
+		// Signature is implicitly tested by compilation and return type
+	}
+}
diff --git a/middleware/logger.go b/middleware/logger.go
new file mode 100644
index 0000000..6f68b93
--- /dev/null
+++ b/middleware/logger.go
@@ -0,0 +1,21 @@
+package middleware
+
+import (
+	"net/http"
+
+	"github.com/platform-mesh/golang-commons/logger"
+)
+
+// StoreLoggerMiddleware returns an HTTP middleware that injects the provided
+// logger into each request's context so downstream handlers can retrieve it.
+func StoreLoggerMiddleware(log *logger.Logger) func(http.Handler) http.Handler {
+	if log == nil {
+		log = logger.StdLogger
+	}
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			ctx := logger.SetLoggerInContext(r.Context(), log)
+			next.ServeHTTP(w, r.WithContext(ctx))
+		})
+	}
+}
diff --git a/middleware/logger_test.go b/middleware/logger_test.go
new file mode 100644
index 0000000..c871b80
--- /dev/null
+++ b/middleware/logger_test.go
@@ -0,0 +1,56 @@
+package middleware
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/platform-mesh/golang-commons/logger"
+	"github.com/platform-mesh/golang-commons/logger/testlogger"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestStoreLoggerMiddleware(t *testing.T) {
+	testLog := testlogger.New()
+
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Verify logger is stored in context
+		logFromContext := logger.LoadLoggerFromContext(r.Context())
+		assert.NotNil(t, logFromContext)
+
+		// The logger should be the same instance we passed
+		assert.Equal(t, testLog.Logger, logFromContext)
+
+		w.WriteHeader(http.StatusOK)
+	})
+
+	middleware := StoreLoggerMiddleware(testLog.Logger)
+	handlerToTest := middleware(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	recorder := httptest.NewRecorder()
+
+	handlerToTest.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+}
+
+func TestStoreLoggerMiddleware_NilLogger(t *testing.T) {
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Even with nil logger, the middleware should not panic
+		w.WriteHeader(http.StatusOK)
+	})
+
+	middleware := StoreLoggerMiddleware(nil)
+	handlerToTest := middleware(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	recorder := httptest.NewRecorder()
+
+	// Should not panic
+	assert.NotPanics(t, func() {
+		handlerToTest.ServeHTTP(recorder, req)
+	})
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+}
diff --git a/middleware/middleware.go b/middleware/middleware.go
new file mode 100644
index 0000000..0e49a42
--- /dev/null
+++ b/middleware/middleware.go
@@ -0,0 +1,18 @@
+package middleware
+
+import (
+	"net/http"
+
+	"github.com/platform-mesh/golang-commons/logger"
+)
+
+// attaches a request-scoped logger (using the provided logger), assigns a request ID, and propagates that ID into the logger.
+func CreateMiddleware(log *logger.Logger) []func(http.Handler) http.Handler {
+	return []func(http.Handler) http.Handler{
+		SetOtelTracingContext(),
+		SentryRecoverer,
+		StoreLoggerMiddleware(log),
+		SetRequestId(),
+		SetRequestIdInLogger(),
+	}
+}
diff --git a/middleware/middleware_test.go b/middleware/middleware_test.go
new file mode 100644
index 0000000..53d3855
--- /dev/null
+++ b/middleware/middleware_test.go
@@ -0,0 +1,41 @@
+package middleware
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/platform-mesh/golang-commons/logger/testlogger"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCreateMiddleware(t *testing.T) {
+	log := testlogger.New()
+	middlewares := CreateMiddleware(log.Logger)
+
+	// Should return 5 middlewares
+	assert.Len(t, middlewares, 5)
+
+	// Each middleware should be a valid function
+	for _, mw := range middlewares {
+		assert.NotNil(t, mw)
+	}
+
+	// Test that middlewares can be chained
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	})
+
+	// Apply all middlewares
+	var finalHandler http.Handler = handler
+	for i := len(middlewares) - 1; i >= 0; i-- {
+		finalHandler = middlewares[i](finalHandler)
+	}
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	recorder := httptest.NewRecorder()
+
+	finalHandler.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+}
diff --git a/middleware/otel.go b/middleware/otel.go
new file mode 100644
index 0000000..1f8b0ae
--- /dev/null
+++ b/middleware/otel.go
@@ -0,0 +1,25 @@
+package middleware
+
+import (
+	"net/http"
+
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/propagation"
+)
+
+// SetOtelTracingContext returns an HTTP middleware that extracts OpenTelemetry
+// tracing context from incoming request headers and injects it into the request's
+// context before passing the request to the next handler.
+//
+// The middleware uses the global OpenTelemetry text map propagator and
+// propagation.HeaderCarrier to read trace/span context from the request headers.
+// Any extraction behavior (including failure handling) is delegated to the
+// propagator implementation.
+func SetOtelTracingContext() func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(responseWriter http.ResponseWriter, request *http.Request) {
+			ctx := otel.GetTextMapPropagator().Extract(request.Context(), propagation.HeaderCarrier(request.Header))
+			next.ServeHTTP(responseWriter, request.WithContext(ctx))
+		})
+	}
+}
diff --git a/middleware/otel_test.go b/middleware/otel_test.go
new file mode 100644
index 0000000..513042d
--- /dev/null
+++ b/middleware/otel_test.go
@@ -0,0 +1,96 @@
+package middleware
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/propagation"
+	"go.opentelemetry.io/otel/trace/noop"
+)
+
+func TestSetOtelTracingContext(t *testing.T) {
+	// Set up a test propagator
+	propagator := propagation.TraceContext{}
+	otel.SetTextMapPropagator(propagator)
+
+	// Create a span context to inject
+	tracer := noop.NewTracerProvider().Tracer("test")
+	ctx, span := tracer.Start(context.Background(), "test-span")
+	span.End()
+
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// The context should have been extracted and set
+		assert.NotNil(t, r.Context())
+		w.WriteHeader(http.StatusOK)
+	})
+
+	middleware := SetOtelTracingContext()
+	handlerToTest := middleware(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+
+	// Inject trace context into headers
+	propagator.Inject(ctx, propagation.HeaderCarrier(req.Header))
+
+	recorder := httptest.NewRecorder()
+
+	handlerToTest.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+}
+
+func TestSetOtelTracingContext_NoTraceHeaders(t *testing.T) {
+	// Set up a test propagator
+	propagator := propagation.TraceContext{}
+	otel.SetTextMapPropagator(propagator)
+
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Even without trace headers, context should be set
+		assert.NotNil(t, r.Context())
+		w.WriteHeader(http.StatusOK)
+	})
+
+	middleware := SetOtelTracingContext()
+	handlerToTest := middleware(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	recorder := httptest.NewRecorder()
+
+	handlerToTest.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+}
+
+func TestSetOtelTracingContext_Integration(t *testing.T) {
+	// Test that the middleware properly integrates with the OpenTelemetry propagation system
+	propagator := propagation.TraceContext{}
+	otel.SetTextMapPropagator(propagator)
+
+	var extractedContext context.Context
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		extractedContext = r.Context()
+		w.WriteHeader(http.StatusOK)
+	})
+
+	middleware := SetOtelTracingContext()
+	handlerToTest := middleware(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+
+	// Add a fake trace header to test extraction
+	req.Header.Set("traceparent", "00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01")
+
+	recorder := httptest.NewRecorder()
+
+	handlerToTest.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+	assert.NotNil(t, extractedContext)
+
+	// Verify that the context is different from the original request context
+	assert.NotEqual(t, req.Context(), extractedContext)
+}
diff --git a/middleware/requestid.go b/middleware/requestid.go
new file mode 100644
index 0000000..3e89023
--- /dev/null
+++ b/middleware/requestid.go
@@ -0,0 +1,59 @@
+package middleware
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/google/uuid"
+	"github.com/platform-mesh/golang-commons/context/keys"
+	"github.com/platform-mesh/golang-commons/logger"
+)
+
+const requestIdHeader = "X-Request-Id"
+
+// SetRequestId returns an HTTP middleware that ensures each request has a request ID.
+// It reads the `X-Request-Id` header (used only if exactly one value is present); otherwise
+// it generates a new UUID. The request ID is stored in the request context under
+// keys.RequestIdCtxKey and the request is forwarded to the next handler with the updated context.
+func SetRequestId() func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(responseWriter http.ResponseWriter, request *http.Request) {
+			ctx := request.Context()
+			var requestId string
+			if ids, ok := request.Header[requestIdHeader]; ok && len(ids) == 1 {
+				requestId = ids[0]
+			} else {
+				// Generate a new request id, header was not received.
+				requestId = uuid.New().String()
+			}
+			ctx = context.WithValue(ctx, keys.RequestIdCtxKey, requestId)
+			next.ServeHTTP(responseWriter, request.WithContext(ctx))
+		})
+	}
+}
+
+// SetRequestIdInLogger returns HTTP middleware that injects a request-scoped logger into the request context.
+// 
+// The middleware loads the current logger from the request context, creates a per-request logger using
+// logger.NewRequestLoggerFromZerolog(ctx, log.Logger), and stores the resulting logger back into the context
+// before calling the next handler. This ensures handlers downstream receive a logger enriched for the current request.
+func SetRequestIdInLogger() func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(responseWriter http.ResponseWriter, request *http.Request) {
+			ctx := request.Context()
+			log := logger.LoadLoggerFromContext(ctx)
+			log = logger.NewRequestLoggerFromZerolog(ctx, log.Logger)
+			ctx = logger.SetLoggerInContext(ctx, log)
+			next.ServeHTTP(responseWriter, request.WithContext(ctx))
+		})
+	}
+}
+
+// GetRequestId returns the request ID stored in ctx under keys.RequestIdCtxKey.
+// If the value is missing or not a string, it returns the empty string.
+func GetRequestId(ctx context.Context) string {
+	if val, ok := ctx.Value(keys.RequestIdCtxKey).(string); ok {
+		return val
+	}
+	return ""
+}
diff --git a/middleware/requestid_test.go b/middleware/requestid_test.go
new file mode 100644
index 0000000..fde6e79
--- /dev/null
+++ b/middleware/requestid_test.go
@@ -0,0 +1,97 @@
+package middleware
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/platform-mesh/golang-commons/context/keys"
+	"github.com/platform-mesh/golang-commons/logger"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSetRequestIdWithIncomingHeader(t *testing.T) {
+
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		val := GetRequestId(r.Context())
+		assert.Equal(t, "123", val)
+	})
+
+	// create the handler to test, using our custom "next" handler
+	handlerToTest := SetRequestId()(nextHandler)
+
+	// create a mock request to use
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	req.Header.Add("X-Request-Id", "123")
+
+	// call the handler using a mock response recorder (we'll not use that anyway)
+	handlerToTest.ServeHTTP(httptest.NewRecorder(), req)
+}
+
+func TestSetRequestIdWitoutIncomingHeader(t *testing.T) {
+
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		val := GetRequestId(r.Context())
+		assert.Len(t, val, 36)
+	})
+
+	// create the handler to test, using our custom "next" handler
+	handlerToTest := SetRequestId()(nextHandler)
+
+	// create a mock request to use
+	req := httptest.NewRequest("GET", "http://testing", nil)
+
+	// call the handler using a mock response recorder (we'll not use that anyway)
+	handlerToTest.ServeHTTP(httptest.NewRecorder(), req)
+}
+
+func TestSetRequestIdInLogger(t *testing.T) {
+	// This test verifies that SetRequestIdInLogger creates a request-aware logger
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// The logger in context should be updated with request information
+		log := logger.LoadLoggerFromContext(r.Context())
+		assert.NotNil(t, log)
+		w.WriteHeader(http.StatusOK)
+	})
+
+	// create the handler to test
+	handlerToTest := SetRequestIdInLogger()(nextHandler)
+
+	// create a mock request to use
+	req := httptest.NewRequest("GET", "http://testing", nil)
+
+	// call the handler using a mock response recorder
+	handlerToTest.ServeHTTP(httptest.NewRecorder(), req)
+}
+
+func TestGetRequestId_WithValidContext(t *testing.T) {
+	requestId := "test-request-id-123"
+
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		retrievedId := GetRequestId(r.Context())
+		assert.Equal(t, requestId, retrievedId)
+	})
+
+	handlerToTest := SetRequestId()(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	req.Header.Add("X-Request-Id", requestId)
+
+	handlerToTest.ServeHTTP(httptest.NewRecorder(), req)
+}
+
+func TestGetRequestId_WithEmptyContext(t *testing.T) {
+	// Test GetRequestId with a context that doesn't have a request ID
+	emptyCtx := context.Background()
+	requestId := GetRequestId(emptyCtx)
+	assert.Empty(t, requestId)
+}
+
+func TestGetRequestId_WithInvalidContextValue(t *testing.T) {
+	// Test GetRequestId with a context that has an invalid request ID value
+	ctx := context.WithValue(context.Background(), keys.RequestIdCtxKey, 123) // not a string
+	requestId := GetRequestId(ctx)
+	assert.Empty(t, requestId)
+}
diff --git a/middleware/sentry.go b/middleware/sentry.go
new file mode 100644
index 0000000..d45ff77
--- /dev/null
+++ b/middleware/sentry.go
@@ -0,0 +1,36 @@
+package middleware
+
+import (
+	"net/http"
+	"runtime/debug"
+	"time"
+
+	"github.com/getsentry/sentry-go"
+	"github.com/platform-mesh/golang-commons/logger"
+)
+
+// Recoverer implements a middleware that recover from panics, sends them to Sentry
+// SentryRecoverer returns an http.Handler that wraps next and recovers from panics.
+//
+// If a panic occurs (except http.ErrAbortHandler) the middleware logs the panic and stack
+// trace, reports the error to the current Sentry hub, flushes Sentry events (up to 5s),
+// and responds with HTTP 500 Internal Server Error. The returned handler otherwise
+// delegates to next.ServeHTTP.
+func SentryRecoverer(next http.Handler) http.Handler {
+	fn := func(w http.ResponseWriter, r *http.Request) {
+		defer func() {
+			if err := recover(); err != nil && err != http.ErrAbortHandler {
+				log := logger.LoadLoggerFromContext(r.Context())
+				log.Error().Interface("panic", err).Interface("stack", debug.Stack()).Msg("recovered http panic")
+				sentry.CurrentHub().Recover(err)
+				sentry.Flush(time.Second * 5)
+
+				w.WriteHeader(http.StatusInternalServerError)
+			}
+		}()
+
+		next.ServeHTTP(w, r)
+	}
+
+	return http.HandlerFunc(fn)
+}
diff --git a/middleware/sentry_test.go b/middleware/sentry_test.go
new file mode 100644
index 0000000..f9705b7
--- /dev/null
+++ b/middleware/sentry_test.go
@@ -0,0 +1,141 @@
+package middleware
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/platform-mesh/golang-commons/logger"
+	"github.com/platform-mesh/golang-commons/logger/testlogger"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSentryRecoverer_NoPanic(t *testing.T) {
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("success"))
+	})
+
+	handlerToTest := SentryRecoverer(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	recorder := httptest.NewRecorder()
+
+	handlerToTest.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+	assert.Equal(t, "success", recorder.Body.String())
+}
+
+func TestSentryRecoverer_WithPanic(t *testing.T) {
+	log := testlogger.New().HideLogOutput()
+
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		panic("test panic")
+	})
+
+	handlerToTest := SentryRecoverer(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	// Add logger to context so the middleware can log the panic
+	ctx := req.Context()
+	ctx = logger.SetLoggerInContext(ctx, log.Logger)
+	req = req.WithContext(ctx)
+
+	recorder := httptest.NewRecorder()
+
+	// Should not panic, should recover
+	assert.NotPanics(t, func() {
+		handlerToTest.ServeHTTP(recorder, req)
+	})
+
+	assert.Equal(t, http.StatusInternalServerError, recorder.Code)
+
+	// Verify that the panic was logged
+	messages, err := log.GetLogMessages()
+	assert.NoError(t, err)
+	assert.NotEmpty(t, messages)
+
+	// Find the panic log message
+	found := false
+	for _, msg := range messages {
+		if msg.Message == "recovered http panic" {
+			found = true
+			break
+		}
+	}
+	assert.True(t, found, "Expected to find panic log message")
+}
+
+func TestSentryRecoverer_WithHttpErrAbortHandler(t *testing.T) {
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// http.ErrAbortHandler should not be recovered
+		panic(http.ErrAbortHandler)
+	})
+
+	handlerToTest := SentryRecoverer(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	recorder := httptest.NewRecorder()
+
+	// The middleware should not recover from http.ErrAbortHandler
+	// Since the condition is `err != http.ErrAbortHandler`, it should let this panic through
+	// However, since the defer recover catches it but doesn't handle it, it won't re-panic
+	// Let's test that it doesn't crash the middleware
+	assert.NotPanics(t, func() {
+		handlerToTest.ServeHTTP(recorder, req)
+	})
+}
+
+func TestSentryRecoverer_WithStringPanic(t *testing.T) {
+	log := testlogger.New().HideLogOutput()
+
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		panic("string panic message")
+	})
+
+	handlerToTest := SentryRecoverer(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	// Add logger to context
+	ctx := req.Context()
+	ctx = logger.SetLoggerInContext(ctx, log.Logger)
+	req = req.WithContext(ctx)
+
+	recorder := httptest.NewRecorder()
+
+	assert.NotPanics(t, func() {
+		handlerToTest.ServeHTTP(recorder, req)
+	})
+
+	assert.Equal(t, http.StatusInternalServerError, recorder.Code)
+
+	// Verify that the panic was logged
+	messages, err := log.GetLogMessages()
+	assert.NoError(t, err)
+	assert.NotEmpty(t, messages)
+}
+
+func TestSentryRecoverer_WithErrorPanic(t *testing.T) {
+	log := testlogger.New().HideLogOutput()
+
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		panic(assert.AnError)
+	})
+
+	handlerToTest := SentryRecoverer(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	// Add logger to context
+	ctx := req.Context()
+	ctx = logger.SetLoggerInContext(ctx, log.Logger)
+	req = req.WithContext(ctx)
+
+	recorder := httptest.NewRecorder()
+
+	assert.NotPanics(t, func() {
+		handlerToTest.ServeHTTP(recorder, req)
+	})
+
+	assert.Equal(t, http.StatusInternalServerError, recorder.Code)
+}
diff --git a/middleware/spiffe.go b/middleware/spiffe.go
new file mode 100644
index 0000000..32a429f
--- /dev/null
+++ b/middleware/spiffe.go
@@ -0,0 +1,27 @@
+package middleware
+
+import (
+	"net/http"
+
+	"github.com/platform-mesh/golang-commons/context"
+	"github.com/platform-mesh/golang-commons/jwt"
+)
+
+// StoreSpiffeHeader returns an HTTP middleware that extracts a SPIFFE URL from the request headers
+// and, if present, inserts it into the request context for downstream handlers.
+//
+// The middleware always calls the next handler; when a SPIFFE URL is found it updates the request's
+// context with that value so subsequent handlers can retrieve it.
+func StoreSpiffeHeader() func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(responseWriter http.ResponseWriter, request *http.Request) {
+			ctx := request.Context()
+			uriVal := jwt.GetSpiffeUrlValue(request.Header)
+
+			if uriVal != nil {
+				ctx = context.AddSpiffeToContext(ctx, *uriVal)
+			}
+			next.ServeHTTP(responseWriter, request.WithContext(ctx))
+		})
+	}
+}
diff --git a/middleware/spiffe_test.go b/middleware/spiffe_test.go
new file mode 100644
index 0000000..84544ff
--- /dev/null
+++ b/middleware/spiffe_test.go
@@ -0,0 +1,160 @@
+package middleware
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/platform-mesh/golang-commons/context"
+	"github.com/platform-mesh/golang-commons/jwt"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestStoreSpiffeHeader_WithValidSpiffeHeader(t *testing.T) {
+	expectedSpiffeID := "spiffe://example.org/workload"
+
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Verify SPIFFE ID is stored in context
+		spiffeFromContext, err := context.GetSpiffeFromContext(r.Context())
+		assert.NoError(t, err)
+		assert.Equal(t, expectedSpiffeID, spiffeFromContext)
+
+		w.WriteHeader(http.StatusOK)
+	})
+
+	middleware := StoreSpiffeHeader()
+	handlerToTest := middleware(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	// Set the SPIFFE header that jwt.GetSpiffeUrlValue expects
+	req.Header.Set("X-Forwarded-Client-Cert", "Subject=\"CN=test\";URI="+expectedSpiffeID)
+	recorder := httptest.NewRecorder()
+
+	handlerToTest.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+}
+
+func TestStoreSpiffeHeader_WithoutSpiffeHeader(t *testing.T) {
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Context should not have SPIFFE ID when no header is present
+		_, err := context.GetSpiffeFromContext(r.Context())
+		assert.Error(t, err) // Should return an error when no SPIFFE ID is present
+
+		w.WriteHeader(http.StatusOK)
+	})
+
+	middleware := StoreSpiffeHeader()
+	handlerToTest := middleware(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	// No SPIFFE header set
+	recorder := httptest.NewRecorder()
+
+	handlerToTest.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+}
+
+func TestStoreSpiffeHeader_WithEmptySpiffeHeader(t *testing.T) {
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Context should not have SPIFFE ID when header is empty
+		_, err := context.GetSpiffeFromContext(r.Context())
+		assert.Error(t, err)
+
+		w.WriteHeader(http.StatusOK)
+	})
+
+	middleware := StoreSpiffeHeader()
+	handlerToTest := middleware(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	req.Header.Set("X-Forwarded-Client-Cert", "")
+	recorder := httptest.NewRecorder()
+
+	handlerToTest.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+}
+
+func TestStoreSpiffeHeader_WithInvalidSpiffeHeader(t *testing.T) {
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Context should not have SPIFFE ID when header is invalid
+		_, err := context.GetSpiffeFromContext(r.Context())
+		assert.Error(t, err)
+
+		w.WriteHeader(http.StatusOK)
+	})
+
+	middleware := StoreSpiffeHeader()
+	handlerToTest := middleware(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	req.Header.Set("X-Forwarded-Client-Cert", "InvalidHeaderValue")
+	recorder := httptest.NewRecorder()
+
+	handlerToTest.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+}
+
+func TestStoreSpiffeHeader_WithMultipleSpiffeHeaders(t *testing.T) {
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// With multiple headers, the behavior depends on jwt.GetSpiffeUrlValue implementation
+		// It should either return the first valid one or handle concatenated headers
+		spiffeFromContext, err := context.GetSpiffeFromContext(r.Context())
+		if err == nil {
+			// If we get a value, it should be a valid SPIFFE ID
+			assert.Contains(t, spiffeFromContext, "spiffe://")
+		}
+
+		w.WriteHeader(http.StatusOK)
+	})
+
+	middleware := StoreSpiffeHeader()
+	handlerToTest := middleware(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	req.Header.Add("X-Forwarded-Client-Cert", "Subject=\"CN=test1\";URI=spiffe://example.org/workload1")
+	req.Header.Add("X-Forwarded-Client-Cert", "Subject=\"CN=test2\";URI=spiffe://example.org/workload2")
+	recorder := httptest.NewRecorder()
+
+	handlerToTest.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+}
+
+func TestStoreSpiffeHeader_Integration(t *testing.T) {
+	// Test the integration with jwt.GetSpiffeUrlValue function
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Verify that the middleware properly uses jwt.GetSpiffeUrlValue
+		spiffeValue := jwt.GetSpiffeUrlValue(r.Header)
+
+		if spiffeValue != nil {
+			spiffeFromContext, err := context.GetSpiffeFromContext(r.Context())
+			assert.NoError(t, err)
+			assert.Equal(t, *spiffeValue, spiffeFromContext)
+		} else {
+			_, err := context.GetSpiffeFromContext(r.Context())
+			assert.Error(t, err)
+		}
+
+		w.WriteHeader(http.StatusOK)
+	})
+
+	middleware := StoreSpiffeHeader()
+	handlerToTest := middleware(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	// Test without header first
+	recorder := httptest.NewRecorder()
+	handlerToTest.ServeHTTP(recorder, req)
+	assert.Equal(t, http.StatusOK, recorder.Code)
+
+	// Test with valid header
+	req = httptest.NewRequest("GET", "http://testing", nil)
+	req.Header.Set("X-Forwarded-Client-Cert", "Subject=\"CN=test\";URI=spiffe://example.org/test")
+	recorder = httptest.NewRecorder()
+	handlerToTest.ServeHTTP(recorder, req)
+	assert.Equal(t, http.StatusOK, recorder.Code)
+}
diff --git a/middleware/test_support/local_middleware.go b/middleware/test_support/local_middleware.go
new file mode 100644
index 0000000..8c96ff5
--- /dev/null
+++ b/middleware/test_support/local_middleware.go
@@ -0,0 +1,35 @@
+//go:build test || local
+
+package local_middleware
+
+import (
+	"net/http"
+
+	"github.com/go-jose/go-jose/v4"
+	"github.com/golang-jwt/jwt/v5"
+
+	"github.com/platform-mesh/golang-commons/context"
+)
+
+// LocalMiddleware returns an HTTP middleware factory that injects a test JWT and tenant ID into each request's context.
+// The returned middleware creates a lightweight, unsigned JWT whose subject is set to userId and whose issuer is "localhost:8080",
+// stores that token (allowed signature algorithm "none") and the provided tenantId in the request context, then calls the next handler.
+// This middleware is intended for local/test use; it will panic if token creation fails.
+func LocalMiddleware(tenantId string, userId string) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(responseWriter http.ResponseWriter, request *http.Request) {
+			ctx := request.Context()
+
+			claims := &jwt.RegisteredClaims{Issuer: "localhost:8080", Subject: userId, Audience: jwt.ClaimStrings{"testing"}}
+			token, err := jwt.NewWithClaims(jwt.SigningMethodNone, claims).SignedString(jwt.UnsafeAllowNoneSignatureType)
+			if err != nil {
+				panic(err) // This shouldn't happen, and if it does, only locally
+			}
+
+			ctx = context.AddWebTokenToContext(ctx, token, []jose.SignatureAlgorithm{"none"})
+			ctx = context.AddTenantToContext(ctx, tenantId)
+
+			next.ServeHTTP(responseWriter, request.WithContext(ctx))
+		})
+	}
+}
diff --git a/middleware/token.go b/middleware/token.go
new file mode 100644
index 0000000..abff5d9
--- /dev/null
+++ b/middleware/token.go
@@ -0,0 +1,36 @@
+package middleware
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/go-http-utils/headers"
+	"github.com/go-jose/go-jose/v4"
+
+	pmcontext "github.com/platform-mesh/golang-commons/context"
+)
+
+const tokenAuthPrefix = "BEARER"
+
+var signatureAlgorithms = []jose.SignatureAlgorithm{jose.RS256}
+
+// StoreWebToken returns middleware that extracts a JWT from the HTTP `Authorization` header
+// and stores it in the request pmcontext for downstream handlers.
+//
+// The middleware looks for an Authorization header of the form `Bearer <token>` (scheme match is
+// case-insensitive). When present, the token is added to the pmcontext via
+// context.AddWebTokenToContext using the package's signatureAlgorithms. If the header is absent,
+// malformed, or not a Bearer token, the request pmcontext is left unchanged.
+func StoreWebToken() func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(responseWriter http.ResponseWriter, request *http.Request) {
+			ctx := request.Context()
+			tokens := strings.Fields(request.Header.Get(headers.Authorization))
+			if len(tokens) == 2 && strings.EqualFold(tokens[0], tokenAuthPrefix) {
+				ctx = pmcontext.AddWebTokenToContext(ctx, tokens[1], signatureAlgorithms)
+			}
+
+			next.ServeHTTP(responseWriter, request.WithContext(ctx))
+		})
+	}
+}
diff --git a/middleware/token_test.go b/middleware/token_test.go
new file mode 100644
index 0000000..9b1d84a
--- /dev/null
+++ b/middleware/token_test.go
@@ -0,0 +1,148 @@
+package middleware
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/go-http-utils/headers"
+	"github.com/platform-mesh/golang-commons/context"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestStoreWebToken_WithFakeBearerToken(t *testing.T) {
+	token := "fake.invalid.token"
+	authHeader := "Bearer " + token
+
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Token parsing will fail due to fake token, which is expected in tests
+		// The middleware should handle this gracefully
+		_, err := context.GetWebTokenFromContext(r.Context())
+		// For test purposes, we just verify the middleware doesn't crash
+		// and that token validation fails as expected with fake tokens
+		assert.Error(t, err) // This is expected behavior when token validation fails
+
+		w.WriteHeader(http.StatusOK)
+	})
+
+	middleware := StoreWebToken()
+	handlerToTest := middleware(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	req.Header.Set(headers.Authorization, authHeader)
+	recorder := httptest.NewRecorder()
+
+	handlerToTest.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+}
+
+func TestStoreWebToken_WithoutAuthHeader(t *testing.T) {
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Context should not have a token
+		_, err := context.GetWebTokenFromContext(r.Context())
+		assert.Error(t, err) // Should return an error when no token is present
+
+		w.WriteHeader(http.StatusOK)
+	})
+
+	middleware := StoreWebToken()
+	handlerToTest := middleware(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	// No authorization header set
+	recorder := httptest.NewRecorder()
+
+	handlerToTest.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+}
+
+func TestStoreWebToken_WithNonBearerToken(t *testing.T) {
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Context should not have a token
+		_, err := context.GetWebTokenFromContext(r.Context())
+		assert.Error(t, err) // Should return an error when no valid token is present
+
+		w.WriteHeader(http.StatusOK)
+	})
+
+	middleware := StoreWebToken()
+	handlerToTest := middleware(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	req.Header.Set(headers.Authorization, "Basic dXNlcjpwYXNz") // Basic auth, not Bearer
+	recorder := httptest.NewRecorder()
+
+	handlerToTest.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+}
+
+func TestStoreWebToken_WithEmptyBearerToken(t *testing.T) {
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Context should not have a token due to empty token
+		_, err := context.GetWebTokenFromContext(r.Context())
+		assert.Error(t, err)
+
+		w.WriteHeader(http.StatusOK)
+	})
+
+	middleware := StoreWebToken()
+	handlerToTest := middleware(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	req.Header.Set(headers.Authorization, "Bearer ")
+	recorder := httptest.NewRecorder()
+
+	handlerToTest.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+}
+
+func TestStoreWebToken_WithFakeBearerTokenLowercase(t *testing.T) {
+	token := "fake.invalid.token"
+	authHeader := "bearer " + token // lowercase
+
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Token parsing will fail due to fake token, which is expected in tests
+		// The middleware should process lowercase bearer tokens but validation will fail
+		_, err := context.GetWebTokenFromContext(r.Context())
+		// This is expected behavior when token validation fails with fake tokens
+		assert.Error(t, err)
+
+		w.WriteHeader(http.StatusOK)
+	})
+
+	middleware := StoreWebToken()
+	handlerToTest := middleware(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	req.Header.Set(headers.Authorization, authHeader)
+	recorder := httptest.NewRecorder()
+
+	handlerToTest.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+}
+
+func TestStoreWebToken_WithMalformedAuthHeader(t *testing.T) {
+	nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Context should not have a token
+		_, err := context.GetWebTokenFromContext(r.Context())
+		assert.Error(t, err)
+
+		w.WriteHeader(http.StatusOK)
+	})
+
+	middleware := StoreWebToken()
+	handlerToTest := middleware(nextHandler)
+
+	req := httptest.NewRequest("GET", "http://testing", nil)
+	req.Header.Set(headers.Authorization, "Bearer") // Missing space and token
+	recorder := httptest.NewRecorder()
+
+	handlerToTest.ServeHTTP(recorder, req)
+
+	assert.Equal(t, http.StatusOK, recorder.Code)
+}