title: Laravel API routes authenticated by user session
body: <p>I've started work on an existing Laravel 5.2 project. I'm needing to build some basic API requests for the front-end of the application to talk with the database. These routes need to be authenticated by the user's session.</p>
  
  <p>I've tried setting up middleware using the auth:api driver, and in ../config/auth.php setting the api['driver'] to 'session'. However, I keep getting 302 redirected to the login page even though the user is authenticated with all permissions and roles.</p>
  
  <p>Can someone recommend some reading or other solution ideas of how to achieve API authentication based on the user session?</p>
  
  <p>from routes/api.php:</p>
  
  <pre><code>Route::group(["middleware" =&gt; ["auth:api"]], function () {
      // results in 302 redirect to /login
      Route::get('test', function(){
          return "TEST";
      });    
  
  });
  </code></pre>
  
  <p>from config/auth.php</p>
  
  <pre><code>'guards' =&gt; [
  'web' =&gt; [
      'driver' =&gt; 'session',
      'provider' =&gt; 'users',
  ],
  
  'api' =&gt; [
      'driver' =&gt; 'session',
      'provider' =&gt; 'users',
  ],
  </code></pre>
  
  <p>app/Http/Kernel.php</p>
  
  <pre><code>&lt;?php
  
  namespace App\Http;
  
  use Illuminate\Foundation\Http\Kernel as HttpKernel;
  
  class Kernel extends HttpKernel
  {
      /**
       * The application's global HTTP middleware stack.
       *
       * These middleware are run during every request to your application.
       *
       * @var array
       */
      protected $middleware = [
          \Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode::class,
          \App\Http\Middleware\NoCache::class,
      ];
  
      /**
       * The application's route middleware groups.
       *
       * @var array
       */
      protected $middlewareGroups = [
          'web' =&gt; [
              \App\Http\Middleware\EncryptCookies::class,
              \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
              \Illuminate\Session\Middleware\StartSession::class,
              \Illuminate\View\Middleware\ShareErrorsFromSession::class,
              \App\Http\Middleware\VerifyCsrfToken::class,
              \Illuminate\Routing\Middleware\SubstituteBindings::class,
          ],
  
          'api' =&gt; [
              'throttle:60,1',
              'bindings',
          ],
      ];
  
      /**
       * The application's route middleware.
       *
       * These middleware may be assigned to groups or used individually.
       *
       * @var array
       */
      protected $routeMiddleware = [
          'auth' =&gt; \App\Http\Middleware\Authenticate::class,
          'auth.basic' =&gt; \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
          'bindings' =&gt; \Illuminate\Routing\Middleware\SubstituteBindings::class,
          'can' =&gt; \Illuminate\Auth\Middleware\Authorize::class,
          'guest' =&gt; \App\Http\Middleware\RedirectIfAuthenticated::class,
          'throttle' =&gt; \Illuminate\Routing\Middleware\ThrottleRequests::class,
          'role' =&gt; \Zizaco\Entrust\Middleware\EntrustRole::class,
          'permission' =&gt; \Zizaco\Entrust\Middleware\EntrustPermission::class,
          'ability' =&gt; \Zizaco\Entrust\Middleware\EntrustAbility::class,
          'dashboard' =&gt; \App\Http\Middleware\dashboardMiddleware::class,
          'system' =&gt; \App\Http\Middleware\systemMiddleware::class
      ];
  }
  </code></pre>