Laravel session based auth:api middleware not working
<p>I tried using the Auth Scaffolding of Laravel 5.3 including the api routes. I wanted to use the session driver for the api guard, but apparently this has no impact whatsoever. After I log into the application with a valid user (so I get from <code>/login</code> to <code>/home</code>) I tried entering the path <code>/api/user</code>, but it always redirects me to <code>/home</code>. The <code>RedirectIfAuthenticated</code> middleware redirects the user.</p>

<p>Here is what I tried and a quick overview of the test application:</p>

<pre><code>// In "app\Http\Middleware\RedirectIfAuthenticated.php"
if (Auth::guard($guard)-&gt;check()) {
    return redirect('/home');
}
</code></pre>

<p><code>$guard</code> is null, and the if is true when browsing to <code>/api/user</code>.</p>

<pre><code>// In "config\auth.php"
'api' =&gt; [
    'driver' =&gt; 'session', // changed from token to session
    'provider' =&gt; 'users',
],
</code></pre>

<p>I changed the driver of the api guard to <code>session</code>.</p>

<pre><code>// In "app\Http\Kernel.php"
'api' =&gt; [
    'throttle:60,1',
    'bindings',
    \App\Http\Middleware\EncryptCookies::class,
    \Illuminate\Session\Middleware\StartSession::class,
],
</code></pre>

<p>I added the middlewares to support cookies in the api middleware</p>

<pre><code>// In "routes\api.php"
Route::get('/user', function (Request $request) {
    return $request-&gt;user();
})-&gt;middleware('auth:api');
</code></pre>

<p>This is an example that comes with a new Laravel installation. </p>

<pre><code>// In "app\Providers\RouteServiceProvider.php"
Route::group([
    'middleware' =&gt; 'api',
    'namespace' =&gt; $this-&gt;namespace,
    'prefix' =&gt; 'api',
], function ($router) {
    require base_path('routes/api.php');
});
</code></pre>

<p>The <code>api</code> middleware is applied to all the routes defined in the <code>api.php</code> file.</p>

<p>I want to be able to query my API after a user has logged in without using tokens, etc. The app I wrote with Laravel 5.2 had basically the same route but only the <code>web</code> middleware group and <code>auth</code> middleware applied to it. In Laravel 5.3, adding the <code>auth</code> middleware leads to the described problem.</p>

<p><strong>edit</strong>: With my configuration I tried the following:</p>

<pre><code>// In "routes\web.php"
Route::get('/test', function (Request $request) {
    return "test";
})-&gt;middleware(['auth']);
</code></pre>

<p>This works perfectly fine, but this doesn't, although the <code>web</code> and the <code>api</code> guard are exactly the same inside the <code>auth.php</code>.</p>

<pre><code>Route::get('/test', function (Request $request) {
    return "test";
})-&gt;middleware(['auth:api']);
</code></pre>