title: Laravel session based auth:api middleware not working
body: <p>I tried using the Auth Scaffolding of Laravel 5.3 including the api routes. I wanted to use the session driver for the api guard, but apparently this has no impact whatsoever. After I log into the application with a valid user (so I get from <code>/login</code> to <code>/home</code>) I tried entering the path <code>/api/user</code>, but it always redirects me to <code>/home</code>. The <code>RedirectIfAuthenticated</code> middleware redirects the user.</p>
  
  <p>Here is what I tried and a quick overview of the test application:</p>
  
  <pre><code>// In "app\Http\Middleware\RedirectIfAuthenticated.php"
  if (Auth::guard($guard)-&gt;check()) {
      return redirect('/home');
  }
  </code></pre>
  
  <p><code>$guard</code> is null, and the if is true when browsing to <code>/api/user</code>.</p>
  
  <pre><code>// In "config\auth.php"
  'api' =&gt; [
      'driver' =&gt; 'session', // changed from token to session
      'provider' =&gt; 'users',
  ],
  </code></pre>
  
  <p>I changed the driver of the api guard to <code>session</code>.</p>
  
  <pre><code>// In "app\Http\Kernel.php"
  'api' =&gt; [
      'throttle:60,1',
      'bindings',
      \App\Http\Middleware\EncryptCookies::class,
      \Illuminate\Session\Middleware\StartSession::class,
  ],
  </code></pre>
  
  <p>I added the middlewares to support cookies in the api middleware</p>
  
  <pre><code>// In "routes\api.php"
  Route::get('/user', function (Request $request) {
      return $request-&gt;user();
  })-&gt;middleware('auth:api');
  </code></pre>
  
  <p>This is an example that comes with a new Laravel installation. </p>
  
  <pre><code>// In "app\Providers\RouteServiceProvider.php"
  Route::group([
      'middleware' =&gt; 'api',
      'namespace' =&gt; $this-&gt;namespace,
      'prefix' =&gt; 'api',
  ], function ($router) {
      require base_path('routes/api.php');
  });
  </code></pre>
  
  <p>The <code>api</code> middleware is applied to all the routes defined in the <code>api.php</code> file.</p>
  
  <p>I want to be able to query my API after a user has logged in without using tokens, etc. The app I wrote with Laravel 5.2 had basically the same route but only the <code>web</code> middleware group and <code>auth</code> middleware applied to it. In Laravel 5.3, adding the <code>auth</code> middleware leads to the described problem.</p>
  
  <p><strong>edit</strong>: With my configuration I tried the following:</p>
  
  <pre><code>// In "routes\web.php"
  Route::get('/test', function (Request $request) {
      return "test";
  })-&gt;middleware(['auth']);
  </code></pre>
  
  <p>This works perfectly fine, but this doesn't, although the <code>web</code> and the <code>api</code> guard are exactly the same inside the <code>auth.php</code>.</p>
  
  <pre><code>Route::get('/test', function (Request $request) {
      return "test";
  })-&gt;middleware(['auth:api']);
  </code></pre>