Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

Ezrab_'s avatar

How to automatically refresh access token in middleware

I'm using laravel passport. When issuing access and refresh tokens I send them to the frontend with httpOnly = true. I made a middleware class which checks if the access token has expired and if the refresh token hasn't expired. If both are the case I call the oauth/token route with refresh_token as grant_type.

All of this works, however I'm not sure how to use the authenticated user inside the controllers. Right now I've set the middleware up that when there's a response it sends the new access and refresh token.

class RefreshAccessToken
{
    /* @var AuthController $authController */
    private $authController;

    /**
     * RefreshAccessToken constructor.
     *
     * @param AuthController $authController
     */
    public function __construct(AuthController $authController)
    {
        $this->authController = $authController;
    }

    /**
     * Handle an incoming request.
     *
     * @param \Illuminate\Http\Request $request
     * @param \Closure                 $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        // User already has an access token
        if ($request->hasCookie('access_token')) {
            return $next($request);
        }

        // User doesn't have an access token and doesn't have a refresh token.
        if (!$request->hasCookie('refresh_token')) {
            return $next($request);
        }

        $response = $next($request);

        $cookies = $this->authController->refreshToken($request);

        return $response
            ->cookie($cookies['access_token'])
            ->cookie($cookies['refresh_token']);
    }
}

Now inside a controller if I want to access the logged in user I always get null as a response:

public function logout()
    {
        dd(auth()->user());
    }
}

Inside the controller's construct method:

$this->middleware('auth:api')->only('logout');
0 likes
1 reply

Please or to participate in this conversation.