# Laravel Sessions & Middleware

> Expert standards for session drivers, security headers, and middleware logic.

- Skill: `mte90/laravel-sessions-middleware` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add mte90/laravel-sessions-middleware`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mte90/laravel-sessions-middleware/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: mte90 (https://skillmd.com/u/mte90)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/mte90/laravel-sessions-middleware

---


# Laravel Sessions & Middleware

## **Priority: P1 (HIGH)**

## Structure

```text
app/Http/
├── Middleware/         # Custom logic layers
└── Kernel.php          # Global/Group registration
```

## Implementation Guidelines

- **Session Driver**: Use `redis` or `memcached` for production/high-density environments.
- **Middleware Chain**: Keep logic granular; one middleware per responsibility.
- **Global Middleware**: Apply via `bootstrap/app.php` only for true globals (logging, headers).
- **Security Headers**: Standardize headers (HSTS, CSP, X-Frame) via dedicated middleware.
- **CSRF Protection**: Ensure `VerifyCsrfToken` is active for all web routes.
- **Session Lifecycle**: Use `$request->session()->regenerate()` after login/privilege changes.

## Anti-Patterns

- **File Streams**: **No file session driver**: Avoid in scaled apps due to I/O locks.
- **Env direct**: **No env('SESSION\_...')**: Always use `config('session...')`.
- **Heavy Bloat**: **No heavy logic in Middleware**: Offload to Services if >10 lines.
- **Trusting Client**: **No sensitive data in Cookies**: Store in server sessions only.

## References

- [Advanced Middleware Patterns](references/implementation.md)