Middleware is lost in FooController's Constructor when App/Http/Controller extends Illuminate/Routing/Controller

[syahnur197]

Laravel Version

12.51.0

PHP Version

8.5.2

Database Driver & Version

No response

Description

Hi, as the title says. There is no middleware registered in the constructor if App\Http\Controller extends Illuminate\Routing\Controller.

Use case: sometimes you might need to do something in the constructor that depends on the middleware. This ability is gone if App\Http\Controller extends Illuminate\Routing\Controller. The workaround right now is to repeat the needed procedure in all of the non constructor methods in the controller since the middlewares will be registered post-constructor.

Steps To Reproduce

Scenario A

Controller.php

abstract class Controller
{
}

Web.php

Route::middleware('bar')->get('dummy', [FooController::class, 'index']);

FooController.php

public function __construct()
{
    throw new Exception('foo'); // you will see middleware web, and bar in the error page
}

public function index()
{
    throw new Exception('foo'); // you will see middleware web, and bar in the error page
}

Scenario B

Controller.php

abstract class Controller extends \Illuminate\Routing\Controller
{
}

Web.php

Route::middleware('bar')->get('dummy', [FooController::class, 'index']);

FooController.php

public function __construct()
{
    throw new Exception('foo'); // you will not see any middlewares here
}

public function index()
{
    throw new Exception('foo'); // you will see middleware web, and bar in the error page
}

Scenario C

Controller.php

abstract class Controller
{

    // taken from Illuminate Routing Controller
    protected $middleware = [];

    public function middleware($middleware, array $options = [])
    {
        foreach ((array) $middleware as $m) {
            $this->middleware[] = [
                'middleware' => $m,
                'options' => &$options,
            ];
        }

        return new ControllerMiddlewareOptions($options);
    }
}

Web.php

Route::middleware('bar')->get('dummy', [FooController::class, 'index']);

FooController.php

public function __construct()
{
    throw new Exception('foo'); // you will not see any middleware here
}

public function index()
{
    throw new Exception('foo'); // you will see middleware web, and bar in the error page
}

looks like Illuminate Routing Controller's getMiddleware, callAction, or __call methods are causing the middlewares are not getting registered in FooController

[sadique-cws]

Hi @syahnur197,

The behavior you are experiencing is due to a known distinction in Laravel regarding eager vs lazy controller instantiation.

When Laravel resolves a request, it needs to gather all middlewares (from both the router and the controller itself) before it runs the middleware pipeline.

1. Scenario B & Eager Instantiation (extends Routing\Controller): When your controller extends Illuminate\Routing\Controller, it inherits the getMiddleware() method. Because getMiddleware() exists, the router is forced to eagerly instantiate your controller to read its middlewares. Since the constructor runs before the middleware pipeline, you do not have access to the session or other pipeline-dependent state (and technically the route middlewares haven't executed yet).
2. Scenario A & Lazy Instantiation: When you don't extend Routing\Controller, the framework performs lazy instantiation. The router runs the middleware pipeline first (like StartSession), and only instantiates the controller right before calling the action method. At this point, the middlewares have run, but you lose the ability to use $this->middleware() since the router had no way to gather them earlier.
3. Scenario C: Here, you copied middleware() but left out getMiddleware(). Because getMiddleware() is missing, the router never asks the controller for its middlewares, which is why your dynamically added middlewares appear to be "lost".

The Solution: HasMiddleware Interface

Laravel 11 introduced the Illuminate\Routing\Controllers\HasMiddleware interface specifically to solve this Catch-22. It allows you to declare middlewares statically, meaning the router doesn't need to eagerly instantiate your controller just to find out what middlewares it requires.

Instead of extending the base controller, implement HasMiddleware and define your middleware statically:

namespace App\Http\Controllers;

use Illuminate\Routing\Controllers\HasMiddleware;
use Illuminate\Routing\Controllers\Middleware;

class FooController implements HasMiddleware
{
    // 1. Declare middlewares statically so they can be gathered early.
    public static function middleware(): array
    {
        return [
            'bar',
            // Or using the Middleware object:
            // new Middleware('log', only: ['index']),
        ];
    }

    public function __construct()
    {
        // 2. The router will now lazily instantiate this class LATE.
        // Therefore, session and other pipeline state will be available here!
        $user = auth()->user(); 
    }

    public function index()
    {
        return 'index';
    }
}

[syahnur197]

bot 👎