If you’re a Laravel developer who’s working with Sanctum for API authentication, you may have run into an issue with route model binding. Specifically, Sanctum seems to ignore the SubstituteBindings middleware that’s responsible for binding route model parameters to their corresponding Eloquent models.
Fortunately, there’s a relatively easy solution to this problem. In this post, I’ll explain how to fix the issue by adding a new middleware alias and updating your route definitions.
The Problem
First, let’s briefly summarize the issue. When you use Sanctum to protect your API routes, it adds its own middleware to the route stack. This middleware checks the incoming request for a valid authentication token, and if one is found, it sets the current user on the request object.
However, this process seems to interfere with the SubstituteBindings middleware that’s included in Laravel by default. This middleware is responsible for automatically binding route model parameters to their corresponding Eloquent models. Without it, you would need to manually query the database to retrieve the model instance for each parameter.
The problem arises because Sanctum’s middleware is executed before SubstituteBindings. As a result, any route model parameters in your route definitions are not automatically bound to their corresponding models, even though you may have set up the required route model bindings in your RouteServiceProvider.
The Solution
To fix this issue, we need to ensure that SubstituteBindings is executed before Sanctum’s middleware. To do this, we’ll add a new middleware alias and update our route definitions accordingly.
Step 1: Add a New Middleware Alias
The first step is to add a new middleware alias that points to SubstituteBindings. This will allow us to reference the middleware by a shorter name in our route definitions.
To do this, open your App\Http\Kernel class and add the following line to the $middlewareAliases property:
'bindings' => \Illuminate\Routing\Middleware\SubstituteBindings::class,This will add a new alias called bindings that points to SubstituteBindings.
Step 2: Update Your Route Definitions
Next, we need to update our route definitions to include the new bindings middleware. Specifically, we need to add it after Sanctum’s middleware in the route stack.
For example, let’s say you have the following route definition:
Route::get('/users/{user}', function (User $user) {
return $user;
});To fix the issue, we need to add the bindings middleware after auth:sanctum, like so:
Route::get('/users/{user}', function (User $user) {
return $user;
})->middleware('auth:sanctum', 'bindings');
This will ensure that SubstituteBindings is executed after Sanctum’s middleware, allowing route model parameters to be automatically bound to their corresponding Eloquent models.
Step 3: Repeat for All Relevant Routes
Finally, you’ll need to repeat Step 2 for all relevant routes in your application. This includes any routes that use route model binding and are protected by Sanctum.
Conclusion
In this post, we’ve looked at how to fix an issue with Laravel Sanctum that prevents route model parameters from being automatically bound to their corresponding Eloquent models. The solution involves adding a new middleware alias and updating your route definitions to include the SubstituteBindings middleware after Sanctum’s middleware.
I hope you found this post helpful! If you have any questions or feedback, feel free to leave a comment below.