Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

xxRockOnxx's avatar

Lumen Session not persisting on every request / Lumen SessionManager

I can't seem to find any way to do sorting of middleware in Lumen. Session auth is being used by the application and the problem is, Authenticate middleware is being called first before StartSession thus resulting in session not behaving properly/not saved.

I know there's SortedMiddleware component but not really sure where to fit that one.

Ideas?

EDIT

Using xdebug to trace the stack, it seems StartSession is called first and then Authenticate next.

After a successful login, Authenticate middleware would fail because it can't get user data from session because it's empty.

0 likes
9 replies
jlrdw's avatar

I am not sure exactly how you are using what. But you may just want to use Laravel for your needs.

I am not 100% sure, but I think most people use lumen for API's and therefore use token based Auth.

xxRockOnxx's avatar

I use either depending on the app it's just that the project is already on Lumen... that needs Session.

Laravel might be considered if it's grows more larger but in its current state, Lumen matches the requirements and switching is not an option right now.

jlrdw's avatar

It shouldn't take too long to switch to laravel, lumen has and uses same components.

How have you dealt with session prior in lumen.

xxRockOnxx's avatar

Session wasn't a requirement back then.

We'll see what else can be done before moving to laravel.

jlrdw's avatar

If this is just now a requirement, I'd start migrating all to laravel, you'll be happy later about it.

xxRockOnxx's avatar

This might seem stupid.

I just setup a laravel demo quickly. I love that it has auth routes and pages for demo available in just a single command.

Can confirm logging in works in the browser but using Postman which I've been using in our Lumen app won't log in. I'm starting to think this is a Postman issue maybe? I'm pretty sure it works before? but it's been a while since I do session so I forgot already.

@talinon yea, have done that already.

xxRockOnxx's avatar
xxRockOnxx
OP
Best Answer
Level 2

Finally figured it out:

@talinon the solution that is found in the link you gave is that, first it tells you to manually register the SessionManager to prevent the unresolvable depedency parameter #0 $app then also register the existing SessionServiceProvider which also binds another instance SessionManager.

Problem with that is, some components use the other instance and other parts use the new one which causes my auth attempt session not being save despite actually being put inside.

I checked around Application.php and saw I can just easily do this in bootstrap/app.php:

$app->singleton(Illuminate\Session\SessionManager::class, function () use ($app) {
    return $app->loadComponent('session', Illuminate\Session\SessionServiceProvider::class, 'session');
});

$app->singleton('session.store', function () use ($app) {
    return $app->loadComponent('session', Illuminate\Session\SessionServiceProvider::class, 'session.store');
});

The answer in this Stackoverflow question helped a lot in explaining: https://stackoverflow.com/questions/35826585/properly-inject-authmanager/35847704

Please or to participate in this conversation.