Laravel/Dusk Authentication Issue

@fylzero Thank you for the reply. I should've picked that up in the documentation. Unfortunately, this does not solve the problem. Authentication still fails with:

$this->browse(function ($browser) use ($user) {
            $browser->loginAs($user)
                    ->visit(route('cafe-menu'))
                    ->assertSeeLink('Menu');
        });

In the DuskTestCase.php I comment out the --headless option to watch what is going on. The loginAs produces a blank white screen with a custom Dusk URL (this looks like the expected behavior). However, the next step is that I am brought to the login page. This is the same behavior I occasionally experience locally, in staging, and in production. However, it is not constant so I haven't been able to pinpoint what is going on.

Here are the routes:

Route::domain('cafe.'.config('app.domain'))->middleware(['cafe'])->group(function () {
    // show the menu
    Route::get('/contact', [ContactController::class, 'index'])->name('cafe-contact');

    // show the menu
    Route::get('/menu', [MenuController::class, 'index'])->name('cafe-menu');

    // show the cart
    Route::get('/cart', [CartController::class, 'index'])->name('cafe-cart');

    // show orders
    Route::get('/orders', [OrdersController::class, 'index'])->name('cafe-orders');

    // admin portal
    Route::get('/admin', [AdminController::class, 'index'])->name('cafe-admin');

    // profile
    Route::get('/user/cafe/profile', [ProfileController::class, 'index'])->name('cafe-user-profile');
});

And here is the middleware:

<?php

namespace App\Http\Middleware;

use App\Models\UserToCafe;
use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;

class CafeCustomer
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle(Request $request, Closure $next)
    {
        // must be a cafe_user
        if (Auth::check() === false) {
            $request->session()->invalidate();
            $request->session()->regenerateToken();
            return redirect()->route('login');
        }

        if (UserToCafe::where('user_id', Auth::id())->count() === 0) {
            return redirect()->route('welcome');
        }

        // check for password reset force
        if ($request->user()->reset_password == 1 && strpos($request->path(), 'profile') == false) {
            session()->flash('info', 'You must reset your password before continuing.');

            return redirect()->route('cafe-user-profile');
        }

        return $next($request);
    }
}

I use the $request->session()->invalidate(); $request->session()->regenerateToken(); because through trial and error I found that it resets whatever the problem is and the second login attempt is successful after the invalidation and regeneration. That's why the second test succeeds.

Using dd() I can see that the issue with the Dusk loginAs is that Auth::check() === false, so I know that's where the problem is.

Any thoughts about what could be causing this?

@TimothePearce Yes I did. I believe my issue was caused because I was using a subdomain and there was an issue with the browser not generating the proper cookie to include the subdomain. To fix this, I added SESSION_DOMAIN='.my-app-name.test' to my local .env file (notice the . before the app name). Run php artisan optimize to make sure the new value takes affect. This is assuming you haven't changed the default 'domain' => env('SESSION_DOMAIN'), in your session.php config file.