How to use custom guard with laravel broadcasting?

Hey guys,

I have problems to get Laravel Broadcasting up and running with a custom guard. I am using the Laravel Webosckets package. Everything is working fine except for authenticating private channels. I always get a 401 error from the auth endpoint. I am using a custom guard to authenticate users. This is working perfectly fine on 'normal' API routes.

Relevant code:

app/Providers/BroadcastServiceProvider.php

<?php

namespace App\Providers;

use Illuminate\Support\Facades\Broadcast;
use Illuminate\Support\ServiceProvider;

class BroadcastServiceProvider extends ServiceProvider
{
    /**
     * Bootstrap any application services.
     *
     * @return void
     */
    public function boot()
    {
        Broadcast::routes(['middleware' => 'auth:vcs']);

        require base_path('routes/channels.php');
    }
}

fromapp/config/auth.php

...
    'guards' => [
        'web' => [
            'driver' => 'session',
            'provider' => 'users',
        ],
        'vcs' => [
            'driver' => 'session',
            'provider' => 'clients',
        ],
    ],

    'providers' => [
        'users' => [
            'driver' => 'eloquent',
            'model' => App\Models\User::class,
        ],

        'clients' => [
            'driver' => 'eloquent',
            'model' => App\Models\Client::class,
        ],
    ],
...

This is how I make the call from the frontend using Laravel Echo:

function joinRoomChat() {
    const token = useCookie('XSRF-TOKEN').value
    const echo = new Echo({
        authEndpoint: `http://localhost/broadcasting/auth`,
        broadcaster: 'pusher',
        key: '123456',
        wsHost: 'localhost',
        wsPort: 6001,
        forceTLS: false,
        disableStats: true,
        auth: {
            headers: {'X-XSRF-TOKEN': token,
                       'Accept': 'application/json',
            },
        }
    });
    echo.join(`room.${roomUuid}`)
    .here((clients) => {
        console.log(client);
    })
    .joining((client) => {
        console.log(client);
    })
    .leaving((client) => {
        console.log(client);
    })
    .error((error) => {
        console.error(error);
    });
}

If I now watch the browser network tab I see the following:

As you can see I make two requests:

1. Request is to a 'normal' API endpoint which also uses the auth:vcs-Middleware.
2. Request comes from laravel echo which tries to authenticate

If I compare the requests I can see that Laravel Echo does not include the session cookie in the request from laravel echo. So it makes sense that I get a 401 error, because the Broadcast controller looks for a session:

from /vendor/laravel/framework/src/Illuminate/Broadcasting/BroadcastController.php

<?php

namespace Illuminate\Broadcasting;

use Illuminate\Http\Request;
use Illuminate\Routing\Controller;
use Illuminate\Support\Facades\Broadcast;
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;

class BroadcastController extends Controller
{
    /**
     * Authenticate the request for channel access.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return \Illuminate\Http\Response
     */
    public function authenticate(Request $request)
    {
        if ($request->hasSession()) {
            $request->session()->reflash();
        }

        return Broadcast::auth($request);
    }

    /**
     * Authenticate the current user.
     *
     * See: https://pusher.com/docs/channels/server_api/authenticating-users/#user-authentication.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return \Illuminate\Http\Response
     */
    public function authenticateUser(Request $request)
    {
        if ($request->hasSession()) {
            $request->session()->reflash();
        }

        return Broadcast::resolveAuthenticatedUser($request)
                    ?? throw new AccessDeniedHttpException;
    }
}

Because Laravel echo does not send the session cookie the controller thinks the user is unauthenticated, even if he is?

So my question is? How do I need to setup Laravel Broadcasting/Echo to authenticate with a custom guard?

I am trying to get this up and running for days now and I would be really thankful for any hint.