title: Laravel 5.6 - Session is not persisting after it expires
body: <p>I have a very weird issue with my two of my local environments. Once my session expires due to not being refreshed for too long, a new session will be created as expected. However, if I am browsing on public site (which is not under Auth protection), the session will not persist and with each get/post request, it will be ignored and a new one will be created (I can see that on XRSF token and new file being created in storage/framework).</p>
  
  <h2>Here are few scenarios:</h2>
  
  <ol>
  <li><p>If no user is logged in, everything works fine.</p></li>
  <li><p>If admin user is logged in (with "Remember me" being checked), but public user is not, accessing any public (unprotected) route (which uses default <code>web</code> middleware) will recreate session as described above. However, once I access any route under <code>admin</code> middlware (<code>web</code> middleware + auth check), session will stick and after that, the issue for public route disappears.</p></li>
  <li><p>If both users are logged in and I access any protected route, session sticks immediately.</p></li>
  </ol>
  
  <h2>I tried the following, without any success:</h2>
  
  <ul>
  <li>reading and trying out suggestions from other threads</li>
  <li>remove all caches</li>
  <li>reinstalled XAMPP</li>
  <li>tried different browsers (same result for Chrome, Edge and freshly installed Firefox)</li>
  <li>setting SESSION_DOMAIN - this actually broke Edge, sessions stopped working altogether</li>
  <li>removed site cookies</li>
  <li>changed APP_URL and APP_NAME</li>
  <li>tried file and database drivers for session</li>
  <li>accessed site using XAMPP through VHost (e.g. <a href="http://mySite/" rel="nofollow noreferrer">http://mySite/</a>) and through php artisan server </li>
  <li>made sure <code>web</code> middleware isn't applied twice to any route</li>
  </ul>
  
  <h2>What resolves the issue:</h2>
  
  <ul>
  <li>accessing protected page</li>
  <li>deleting cookies</li>
  <li>reopening browser</li>
  </ul>
  
  <h2>Environments where I reproduced the issue:</h2>
  
  <ol>
  <li><p>My PC</p>
  
  <ul>
  <li>Windows 10 Pro x64, build 1709</li>
  <li>PHP 7.2.0 (XAMPP)</li>
  </ul></li>
  <li><p>My laptop</p>
  
  <ul>
  <li>Windows 10 Pro x64, build 1803</li>
  <li>PHP 7.2.7 (XAMPP)</li>
  </ul></li>
  <li><p>Colleague's laptop</p>
  
  <ul>
  <li>macOS High Sierra 10.13.6</li>
  <li>PHP 7.2.1 (MAMP)</li>
  </ul></li>
  </ol>
  
  <h2>What probably does not cause the issue:</h2>
  
  <ul>
  <li>file permissions</li>
  <li>my Laravel configuration (as I tried dozen of suggestions in similar threads)</li>
  <li>XAMPP or MAMP</li>
  <li>OS</li>
  </ul>
  
  <h2>What might caused the issue:</h2>
  
  <ul>
  <li>cookies (although I have no idea how)</li>
  <li>PHP settings</li>
  <li>Laravel (given the weird behavior in given scenarios, I cannot exclude this option yet)</li>
  </ul>
  
  <hr>
  
  <p>Here are some files that might be useful for you:</p>
  
  <h2>.env</h2>
  
  <pre><code>APP_NAME=MySite
  APP_ENV=local
  APP_KEY=base64:dEoI03jGqlhIZS4om6sx7j7aFMmKEweJpN72PijsCTQ=
  APP_DEBUG=true
  APP_URL=http://mySite
  
  LOG_CHANNEL=stack
  
  DB_CONNECTION=mysql
  DB_HOST=localhost
  DB_PORT=3306
  DB_DATABASE=mySite
  DB_USERNAME=root
  DB_PASSWORD=password
  
  BROADCAST_DRIVER=log
  CACHE_DRIVER=file
  SESSION_DRIVER=file
  SESSION_LIFETIME=120
  QUEUE_DRIVER=sync
  
  REDIS_HOST=127.0.0.1
  REDIS_PASSWORD=null
  REDIS_PORT=6379
  
  MAIL_DRIVER=smtp
  MAIL_HOST=smtp.mailtrap.io
  MAIL_PORT=2525
  MAIL_USERNAME=null
  MAIL_PASSWORD=null
  MAIL_ENCRYPTION=null
  
  PUSHER_APP_ID=
  PUSHER_APP_KEY=
  PUSHER_APP_SECRET=
  PUSHER_APP_CLUSTER=mt1
  
  MIX_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
  MIX_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"
  </code></pre>
  
  <h2>RouteServiceProvider.php</h2>
  
  <pre><code>&lt;?php
  
  namespace App\Providers;
  
  use Illuminate\Support\Facades\Route;
  use Illuminate\Foundation\Support\Providers\RouteServiceProvider as ServiceProvider;
  
  class RouteServiceProvider extends ServiceProvider
  {
      /**
       * This namespace is applied to your controller routes.
       *
       * In addition, it is set as the URL generator's root namespace.
       *
       * @var string
       */
      protected $namespace = 'App\Http\Controllers';
  
      /**
       * Define your route model bindings, pattern filters, etc.
       *
       * @return void
       */
      public function boot()
      {
          //
  
          parent::boot();
      }
  
      /**
       * Define the routes for the application.
       *
       * @return void
       */
      public function map()
      {
          $this-&gt;mapApiRoutes();
  
          $this-&gt;mapPublicRoutes();
  
          $this-&gt;mapOrganizationRoutes();
  
          $this-&gt;mapVolunteerRoutes();
  
          $this-&gt;mapAdminRoutes();
      }
  
      /**
       * Define the "web" routes for the application.
       *
       * These routes all receive session state, CSRF protection, etc.
       *
       * @return void
       */
      protected function mapAdminRoutes()
      {
          Route::middleware('admin')
               -&gt;prefix("admin")
               -&gt;namespace($this-&gt;namespace."\Admin")
               -&gt;group(base_path('routes/admin.php'));
      }
  
      /**
       * Define the "web" routes for the application.
       *
       * These routes all receive session state, CSRF protection, etc.
       *
       * @return void
       */
      protected function mapPublicRoutes()
      {
          Route::middleware('web')
               -&gt;namespace($this-&gt;namespace)
               -&gt;group(base_path('routes/public.php'));
      }
  
      /**
       * Define the "organization" routes for the application.
       *
       * These routes all receive session state, CSRF protection, etc.
       * It also contains auth protection and nav builder
       *
       * @return void
       */
      protected function mapOrganizationRoutes()
      {
          Route::middleware('organization')
               -&gt;prefix("organization")
               -&gt;namespace($this-&gt;namespace . "\Organization")
               -&gt;group(base_path('routes/organization.php'));
      }
  
      /**
       * Define the "volunteer" routes for the application.
       *
       * These routes all receive session state, CSRF protection, etc.
       * It also contains auth protection and nav builder
       *
       * @return void
       */
      protected function mapVolunteerRoutes()
      {
          Route::middleware('volunteer')
               -&gt;prefix("volunteer")
               -&gt;namespace($this-&gt;namespace . "\Volunteer")
               -&gt;group(base_path('routes/volunteer.php'));
      }
  
      /**
       * Define the "api" routes for the application.
       *
       * These routes are typically stateless.
       *
       * @return void
       */
      protected function mapApiRoutes()
      {
          Route::prefix('api')
               -&gt;middleware('api')
               -&gt;namespace($this-&gt;namespace)
               -&gt;group(base_path('routes/api.php'));
      }
  }
  </code></pre>
  
  <h2>routes/public.php</h2>
  
  <pre><code>&lt;?php
  
  /*
  |--------------------------------------------------------------------------
  | Web Routes
  |--------------------------------------------------------------------------
  |
  | Here is where you can register public routes for your application. These
  | routes are loaded by the RouteServiceProvider within a group which
  | contains the "web" middleware group. Now create something great!
  |
  */
  
  Route::get('/', "LandingController@getIndex");
  
  Route::group(["prefix" =&gt; "/auth"], function () {
  
      Route::get('/logout/{guard}', 'Common\AuthController@getLogout')-&gt;name('logout.get');
  
      Route::get('/login', 'Common\AuthController@getLogin')-&gt;name('login.get');
      Route::post('/login', 'Common\AuthController@postLogin')-&gt;name('login.post');
  
      Route::get('/register/{guard}', 'Common\RegistrationController@getRegister')-&gt;name('register.get');
      Route::post('/register/{guard}', 'Common\RegistrationController@postRegister')-&gt;name('register.post');
  
      Route::get("/register/success/{guard}", "Common\RegistrationController@getSuccess")-&gt;name("register.success.get");
  
  });
  
  Route::group(["prefix" =&gt; "admin/auth"], function() {
  
      Route::get("/login", "Admin\AuthController@getLogin")-&gt;name("admin.auth.login.get");
      Route::post("/login", "Admin\AuthController@postLogin")-&gt;name("admin.auth.login.post");
  
      Route::get("/logout", "Admin\AuthController@getLogout")-&gt;name("admin.auth.logout.get");
  
  });
  </code></pre>
  
  <h2>routes/admin.php</h2>
  
  <pre><code>&lt;?php
  
  /*
  |--------------------------------------------------------------------------
  | Web Routes
  |--------------------------------------------------------------------------
  |
  | Here is where you can register web routes for your application. These
  | routes are loaded by the RouteServiceProvider within a group which
  | contains the "admin" middleware group. Routes are prefixed with "/admin"
  | Now create something great!
  |
  */
  
  Route::get("/", "DashboardController@getIndex")-&gt;name("admin.dashboard");
  
  // rest omitted
  </code></pre>
  
  <h2>Http/Kernel.php</h2>
  
  <pre><code>&lt;?php
  
  namespace App\Http;
  
  use Illuminate\Foundation\Http\Kernel as HttpKernel;
  
  class Kernel extends HttpKernel
  {
      /**
       * The application's global HTTP middleware stack.
       *
       * These middleware are run during every request to your application.
       *
       * @var array
       */
      protected $middleware = [
          \Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode::class,
          \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
          \App\Http\Middleware\TrimStrings::class,
          \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
          \App\Http\Middleware\TrustProxies::class,
      ];
  
      /**
       * The application's route middleware groups.
       *
       * @var array
       */
      protected $middlewareGroups = [
          'web' =&gt; [
              \App\Http\Middleware\EncryptCookies::class,
              \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
              \Illuminate\Session\Middleware\StartSession::class,
              // \Illuminate\Session\Middleware\AuthenticateSession::class,
              \Illuminate\View\Middleware\ShareErrorsFromSession::class,
              \App\Http\Middleware\VerifyCsrfToken::class,
              \Illuminate\Routing\Middleware\SubstituteBindings::class,
          ],
  
          'api' =&gt; [
              'throttle:60,1',
              'bindings',
          ],
  
          'admin' =&gt; [
              'web',
              'auth:admin',
              'nav:admin', // nav is custom middleware for loading navigation config to nwidart/laravel-menus library
          ],
  
          'organization' =&gt; [
              'web',
              'auth:organization',
              'nav:organization',
          ],
  
          'volunteer' =&gt; [
              'web',
              'auth:volunteer',
              'nav:volunteer',
          ],
      ];
  
      /**
       * The application's route middleware.
       *
       * These middleware may be assigned to groups or used individually.
       *
       * @var array
       */
      protected $routeMiddleware = [
          //'auth' =&gt; \Illuminate\Auth\Middleware\Authenticate::class,
          'auth' =&gt; \App\Http\Middleware\AuthMiddleware::class,
          'auth.basic' =&gt; \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
          'bindings' =&gt; \Illuminate\Routing\Middleware\SubstituteBindings::class,
          'cache.headers' =&gt; \Illuminate\Http\Middleware\SetCacheHeaders::class,
          'can' =&gt; \Illuminate\Auth\Middleware\Authorize::class,
          'guest' =&gt; \App\Http\Middleware\RedirectIfAuthenticated::class,
          'signed' =&gt; \Illuminate\Routing\Middleware\ValidateSignature::class,
          'throttle' =&gt; \Illuminate\Routing\Middleware\ThrottleRequests::class,
          'nav' =&gt; \App\Http\Middleware\NavigationBuilder::class,
      ];
  }
  </code></pre>
  
  <h2>AuthMiddlware.php</h2>
  
  <pre><code>&lt;?php
  
  namespace App\Http\Middleware;
  
  use Closure;
  use Illuminate\Support\Facades\Auth;
  
  class AuthMiddleware {
      /**
       * Handle an incoming request.
       *
       * @param  \Illuminate\Http\Request  $request
       * @param  \Closure  $next
       * @param  string  $guard
       * @return mixed
       */
      public function handle($request, Closure $next, $guard) {
          if (!Auth::guard($guard)-&gt;check()) {
              return redirect()-&gt;route(config("auth.guards.$guard.redirect"));
          }
  
          return $next($request);
      }
  }
  </code></pre>
  
  <hr>
  
  <p>To end this, I would like to say that any suggestion or comment is welcomed. I need to determine if this is my local issue, or if this has something to do with Laravel so that I can open an issue on their GitHub page.</p>