Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

megaman's avatar

session on api routes

I am attempting to use some middleware provided by a package on some api routes It throws an error because session is not available.

Is there any way arround this without refactoring the package?

0 likes
9 replies
Cronix's avatar

Look at your app/Http/kernel.php

You'll see this in the web group, but not in the api group.

\Illuminate\Session\Middleware\StartSession::class,

So either copy it into the api group, or add it to protected $middleware array and remove it from web group. The protected $middleware group runs for all requests, where web is only web routes and api is api routes. Basically you don't want it to load twice.

megaman's avatar

Cronix, I am not sure that would work

A session is seperate for each client and a client is usually a browser. However i my project there are 2 laravel projects. One project is a gateway which the users (via their browsers) connect to directly. The second other is the API which actually provides the services and has access to various datasources

The gateway project makes all HTTP requests to the API project This means there is only one "client" connecting no matter how many users there are or put another way each user does not have his own unique session with the API

Cronix's avatar

Then it really sounds like this "package" that requires session, isn't suitable to use in your api. I understand what session is. Normally you don't use one with apis, but you asked...

megaman's avatar

Cronix Indeed but we did not realize that this package required session until the very last stage of developing the feature which we want to use it for

jlrdw's avatar

If I promise not to reply, will you at least reveal the mystery package to @Cronix

I will read thread, but won't reply. I am curious. Or is it a package you developed?

megaman's avatar

the package is antonioribeiro/google2fa-laravel

i tried to post the name twice but once it blocked me for re-posting too soon and the other time the post did not appear

Snapey's avatar

Ha thats so funny. Its a two factor authentication package but you want to use it for something other than authentication?

megaman's avatar

"Ha thats so funny. Its a two factor authentication package but you want to use it for something other than authentication?"

NO!

I am using it for exactly that a second type of authentication.

and at no point did i say anything otherwise!

I use passport for oauth and this package for OTP

Please or to participate in this conversation.