Class construct runs before middleware.

[yasincinar]

• Laravel Version: 5.3.24
• PHP Version:7.0.8

Description:

I have two projects made by Laravel one of them version is 5.2.43 and the other version is 5.3.24. I run same demo project in two version, in the first one (which is 5.2.43) middleware run before constructor, but in the second one (which is 5.3.24) constructor run before middleware. Is it a bug or new feature ?

There is a "dd('middleware')" In the middleware and another "dd('construct')" in the __consturct function of the controller. Outputs below;

Laravel version(5.2.43) => middleware (dd() in the middleware runs)
Laravel version(5.3.24) => construct (dd() in the __consturct function runs)

Steps To Reproduce:

[salihklc]

I have exactly same issue 😟

[fernandobandeira]

Check #15072, this is intentional...

[bobbybouwmann]

This is intentional, see the upgrade guide: https://laravel.com/docs/5.3/upgrade#upgrade-5.3.0 (scroll to the Controllers section)

In previous versions of Laravel, you could access session variables or the authenticated user in your controller's constructor. This was never intended to be an explicit feature of the framework. In Laravel 5.3, you can't access the session or authenticated user in your controller's constructor because the middleware has not run yet.

[salihklc]

Yeap I saw this but, I was checking all authorization things in the middleware and after the authorization I get the current user info in the parent construct for all child class. How can I upgrade my old 5.2 or 5.1 project to 5.3. Also read the @fernandobandeira 's notes and I will try @mreschke solution - this one - but is it right solution ?

[themsaid]

More details here as well: https://laravel-news.com/2016/08/controller-construct-session-changes-in-laravel-5-3/

[themsaid]

Hope that helps :)

[salihklc]

It solve the problem yea but I have to write all code in that scope 😞

[christhomas]

I'd like to talk about this issue again because in 2022, I've got a problem that is exactly related to this issue.

I understand that they think accessing session variables etc in the controller is a bad thing, I totally undestand that. But what I don't understand is what that has to do with the construction of the controller before the middleware has executed.

Isn't the point of a middleware, is that it runs in the middle of where you are and where you wanna go? So Router middleware run between the router and the controller(or closure) that will be triggered after all the middleware have been passed through?

This seems to be jumping the gun, by constructing an object ahead of time, but you don't even know if you want that object and all it's dependency tree. I have a problem now which is caused by the construction of the controller before I want it constructed and as a result one of the dependencies throws an exception because the middleware did not run yet and did not adjust the request based on the circumstances.