Bug: auth.required middleware is not triggered on dynamic routes within app()->group() #32

ronaldomussa · 2025-04-07T19:41:11Z

When using auth.required middleware inside app()->group(), dynamic routes like /clients/{id} skip the middleware execution. This causes the controller to be executed even if there’s no authenticated user.

It works fine on static routes like /clients, but on dynamic ones, the middleware is ignored.

Steps to reproduce the behavior:

In your routes/web.php, define a middleware group:

app()->group('/cms', [
    'middleware' => 'auth.required',
    function () {
        app()->get('/clients', 'Auth\ClientController@index');
        app()->get('/clients/{id}', 'Auth\ClientController@show');
    }
]);

Ensure your auth.required middleware redirects if the user is not logged in.

Access /cms/clients while logged out → ✅ Middleware works (redirects).

Access /cms/clients/1 while logged out → ❌ Controller runs, middleware is skipped.

Expected behavior
All routes (static or dynamic) inside the app()->group() with auth.required should be protected. If a user is not logged in, the middleware should redirect and prevent controller execution.

Additional context
Leaf version: v3.x

Middleware is registered via auth()->middleware('auth.required', callback)

DevTools log shows controller is called before the middleware on dynamic routes.

The text was updated successfully, but these errors were encountered:

mychidarko · 2025-04-07T22:23:11Z

Hi @ronaldomussa, I'm just seeing this. Will try to replicate on my end, thanks for the detail

ronaldomussa · 2025-04-08T02:01:10Z

Hello @mychidarko, I just fix this issue on leaf/src/Router.php with this code replacing the line 827

$routesToRun = array_filter($routeToHandle, function ($route) use ($uri) {
          $pattern = $route['route']['pattern'];
      
          // Converte para regex se contiver parâmetros dinâmicos
          $regexPattern = '#^' . preg_replace('/\{[^}]+\}/', '([^/]+)', $pattern) . '$#';
      
          return preg_match($regexPattern, $uri)
              || $pattern === $uri
              || $pattern === '/.*'
              || implode('/', $route['params'] ?? []) === ltrim($uri, '/');
      });

Root cause
In Router.php, the current logic inside handle() uses a direct equality check on $route['route']['pattern'] === $uri, which fails for dynamic route patterns.

Fix
This PR replaces that brittle check with a preg_match to verify if the route pattern matches the URI:

This fix was tested in a real project using dynamic routes inside a group with middleware. After this change, middleware was properly triggered before controller execution.

mychidarko transferred this issue from leafsphp/leaf Apr 7, 2025

mychidarko marked this as a duplicate of #31 Apr 7, 2025

ronaldomussa closed this as completed Apr 8, 2025

ronaldomussa reopened this Apr 8, 2025

mychidarko added the bug Something isn't working label Apr 12, 2025 — with Linear

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Bug: auth.required middleware is not triggered on dynamic routes within app()->group() #32

Bug: auth.required middleware is not triggered on dynamic routes within app()->group() #32

Uh oh!

Uh oh!

Uh oh!

Bug: auth.required middleware is not triggered on dynamic routes within app()->group() #32

Bug: auth.required middleware is not triggered on dynamic routes within app()->group() #32

Comments

Uh oh!

Uh oh!

Uh oh!