Laravel 11 - Api unauthorized requests redirects to login page

Okay, for anyone searching for this later who is like me and couldn't quite make Laravel 11 make this work, I solved the issue for Laravel 11+Sanctum and the api routes needing to have the Accepts:application/json added automatically.

For me, it was a matter of not wanting to manually have to change hundreds of fetch requests in the finished SPA that is NOW going to use the Laravel 11 API system.

Per the Laravel 11 Middleware Groups documentation, and reading various places including this thread here is what I did.

1. Created a Middleware file called ApiForceJsonResponse

<?php  
namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

class ApiForceJsonResponse
{
    /**
     * Handle an incoming request.
     *
     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
     */
    public function handle(Request $request, Closure $next) : Response
    {
        $request->headers->set('Accept', 'application/json');
        return $next($request);
    }
}

That was the easy part, but knowing where to put it in Laravel 11 was the trickier part for me. In the end it was super simple, but took forever to find.

It's in the documentation very clearly, but for some reason I had to read it a dozen times before I realized it was so simple.

So here is my bootstrap/app.php file now with the class referenced in the api group. It's important as noted by @pr0f3ss0r that we use PREPEND in the grouping so it all happens before the route triggers.

<?php

use Illuminate\Foundation\Application;
use Illuminate\Foundation\Configuration\Exceptions;
use Illuminate\Foundation\Configuration\Middleware;
use Illuminate\Support\Facades\Route;

use App\Http\Middleware\RestrictIpAddressMiddleware;

use Illuminate\Http\Request;
use Illuminate\Auth\AuthenticationException;


return Application::configure(basePath: dirname(__DIR__))

    ->withRouting(
        web: __DIR__ . '/../routes/web.php',
        api: __DIR__ . '/../routes/api.php',
        commands: __DIR__ . '/../routes/console.php',
        health: '/up',

        //. custom v1 routes per laracast master class tutorial
        then: function () {
            // Route::middleware(['api', 'auth:sanctum'])
            Route::middleware(['api'])
                ->prefix('api/v1') 
                ->name('api_v1.')
                ->group(base_path('routes/api_v1.php'));
        },
    )

    ->withMiddleware(function (Middleware $middleware) {
        
		// here is the prepend of the forceJsonResponse class!
        $middleware->api(prepend: [
            \App\Http\Middleware\ApiForceJsonResponse::class,
        ]);

        $middleware->redirectGuestsTo(function (Request $request) {
            if ($request->is('api/*')) {
                return response()->json([
                    'ok' => false,
                    'message' => "In withMiddleware: Custom Unauthenticated message because no accept header!",
                    'msg' => "In withMiddleware: Custom Unauthenticated message because no accept header!",
                ], 401);
            } else {
                return route('/');
            }
        });
    })


// helps with the error messages and redirect to /login with unauthenticated api requests.
    ->withExceptions(function (Exceptions $exceptions) {
        $exceptions->render(function (AuthenticationException $e, Request $request) {
            if ($request->is('api/*')) {
                return response()->json([
                    'ok' => false,
                    'msg' => $e->getMessage(),
                    'message' => $e->getMessage(),
                ], 401);
            }
        });
    })->create();

Hope this helps someone out who spent hours trying to figure this out!! I am new to Laravel and did a crash course recently on version 8, then to write my API installed version 11 figuring "it can't be that different, right?" And it's not, except where it is!!!

A slight improvment on the handle function in order to account for possibility that an accept header is already present and not to alter it other than to add the accept application/json if not present.

    public function handle(Request $request, Closure $next) : Response
    {
        // Retrieve the current 'Accept' header
        $acceptHeader = $request->header('Accept');

        // Check if 'application/json' is already included
        if (strpos($acceptHeader, 'application/json') === false) {
            if (!empty($acceptHeader)) {
                // If other values exist, append 'application/json'
                $request->headers->set('Accept', $acceptHeader . ', application/json');
            } else {
                // If no 'Accept' header exists, set it to 'application/json'
                $request->headers->set('Accept', 'application/json');
            }
        }
        
        return $next($request);
    }

I was wondering if there is a configuration in Laravel 11 to handle authentication exceptions gracefully (particularly for api), rather than attempting to redirect to route('login'), which results in a RouteNotFoundException. I’ve noticed in some blog posts that a RouteNotFoundException is returned instead of an Unauthorized or Unauthenticated 401 error.

I tried implementing a workaround, but it doesn’t seem ideal. I used the following code to inform the frontend that the error was related to authentication:

if (str_contains($e->getMessage(), 'login')) {
    return response()->json(
        [
            'success' => false,
            'message' => 'Unauthorized'
        ],
        401
    );
}

Here’s how my exception handling is configured:

->withExceptions(function (Exceptions $exceptions) {

    // Handle Authentication Exception
    $exceptions->render(function (AuthenticationException $e, Request $request) {
        return response()->json(['message' => 'Unauthenticated.'], 401);
    });

    // Handle Validation Exception
    $exceptions->render(function (ValidationException $e, Request $request) {
        return response()->json([
            'message' => 'Validation Error',
            'errors' => $e->errors(),
        ], 422);
    });

    // Handle Route Not Found Exception
    $exceptions->render(function (RouteNotFoundException $e, Request $request) {
        // Check if the exception message contains anything related to login
        if (str_contains($e->getMessage(), 'login')) {
            return response()->json(
                [
                    'success' => false,
                    'message' => 'Unauthorized'
                ],
                401
            );
        }
        
        return response()->json(
            [
                'success' => false,
                'message' => 'Endpoint not found.'
            ],
            404
        );
    });