Search code examples
phplaravelauthenticationcsrf

Laravel Auth strange behavior

I have a domain and subdomain based app (all in one Laravel project). I have set up CORS and CSRF so that communication works. I've also replaced the cookie domain under session.php and now the session is shared across domain and subdomain.

I have an issue when logging in however. When I log in (either from domain or subdomain) user gets logged in. I can check that by dumping Auth::user() under my web.php. However when I try to dump it from middleware I get null.

How is that possible?

I tried clearing caches on both app and browser

Solution

  • I found the issue.

    I was calling my middleware before the session middleware under Kernel.php

    NOTE

    Global middleware is called before web middleware