laravel upgraded 9 to 11, I'm getting $request->user() and Auth::user() null value in web route. I'm using php-open-source-saver/jwt-auth

routes/web.php

Route::get('customer/{id}', [FrontendController::class, 'home']);

app/Http/Controllers/FrontendController.php

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;

public function home(Request $request)
{
    dd($request->user(), Auth::user());
}

bootstrap/app.php

->withRouting(
    web: __DIR__ . '/../routes/web.php',
    api: [
        __DIR__ . '/../routes/api/core.php',
        __DIR__ . '/../routes/api/user.php'
    ],
    commands: __DIR__ . '/../routes/console.php',
    health: '/up'
)
->withMiddleware(function (Middleware $middleware) {
    //dd($middleware->getMiddlewareGroups());
})
->withExceptions(function (Exceptions $exceptions) {
    //
})->create();

Middleware groups showing when dd($middleware->getMiddlewareGroups())

"web" => [
    0 => "Illuminate\Cookie\Middleware\EncryptCookies",
    1 => "Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse",
    2 => "Illuminate\Session\Middleware\StartSession",
    3 => "Illuminate\View\Middleware\ShareErrorsFromSession",
    4 => "Illuminate\Foundation\Http\Middleware\ValidateCsrfToken",
    5 => "Illuminate\Routing\Middleware\SubstituteBindings",
],
"api" => [
    0 => "Illuminate\Routing\Middleware\SubstituteBindings"
]

Config file

config/auth.php

'defaults' => [
    'guard' => 'api',
    'passwords' => 'users',
],

'guards' => [
    'web' => [
        'driver' => 'session',
        'provider' => 'users',
    ],

    'api' => [
        'driver' => 'jwt',
        'provider' => 'users',
    ],
],

config/session.php

'driver' => 'file'

Environment

laravel upgraded 9 to 11, I'm getting $request->user() and Auth::user() null value in web route. I'm using php-open-source-saver/jwt-auth

routes/web.php

Route::get('customer/{id}', [FrontendController::class, 'home']);

app/Http/Controllers/FrontendController.php

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;

public function home(Request $request)
{
    dd($request->user(), Auth::user());
}

bootstrap/app.php

->withRouting(
    web: __DIR__ . '/../routes/web.php',
    api: [
        __DIR__ . '/../routes/api/core.php',
        __DIR__ . '/../routes/api/user.php'
    ],
    commands: __DIR__ . '/../routes/console.php',
    health: '/up'
)
->withMiddleware(function (Middleware $middleware) {
    //dd($middleware->getMiddlewareGroups());
})
->withExceptions(function (Exceptions $exceptions) {
    //
})->create();

Middleware groups showing when dd($middleware->getMiddlewareGroups())

"web" => [
    0 => "Illuminate\Cookie\Middleware\EncryptCookies",
    1 => "Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse",
    2 => "Illuminate\Session\Middleware\StartSession",
    3 => "Illuminate\View\Middleware\ShareErrorsFromSession",
    4 => "Illuminate\Foundation\Http\Middleware\ValidateCsrfToken",
    5 => "Illuminate\Routing\Middleware\SubstituteBindings",
],
"api" => [
    0 => "Illuminate\Routing\Middleware\SubstituteBindings"
]

Config file

config/auth.php

'defaults' => [
    'guard' => 'api',
    'passwords' => 'users',
],

'guards' => [
    'web' => [
        'driver' => 'session',
        'provider' => 'users',
    ],

    'api' => [
        'driver' => 'jwt',
        'provider' => 'users',
    ],
],

config/session.php

'driver' => 'file'

Environment

Expected behaviour

$request->user() or Auth::user() should be a logged-in user in the controller.

Actual behaviour

$request->user() and Auth::user() both are getting null

• php
• laravel
• jwt

• 1 check the middlewares that are applied to your specific route, and post them in your question, example php artisan route:list --path=customer – kris gjika Commented Mar 7 at 12:44
• only web middleware applied for this route, I have check using this command php artisan route:list -v – Jitendra Patel Commented Mar 10 at 4:57

2 Answers 2

You're using JWT (stateless authentication), but the route you're hitting is defined in web.php, which uses the web middleware group. This group is session-based (Laravel's default), not JWT-based.

So when you call:

$request->user() 
Auth::user()

It uses the default session guard (web), but you're authenticated using the api guard (jwt)—hence, null.

Use auth:api middleware on web routes

Route::middleware('auth:api')->get('customer/{id}', [FrontendController::class, 'home']);

only web middleware applied for this route, I have check using this command php artisan route:list -v

This is the point in order to have authenticated user, the route must be in auth middleware group (auth or auth:api)

Route::group(['middleware' => 'auth'], function(){
   /** your routes go here */
});

or for single route

Route::get('someroute', [Controller::class, 'method'])->middleware('auth');

==== Edit 8/4/25 ==== In your case this will not work: you are authorising api requests, not web requests.

Move routes to api.php (core.php in your case)