Unexpected missing Set-Cookie/session headers without `php artisan optimize`

[yudhees]

Laravel Version

10

PHP Version

8.2

Database Driver & Version

No response

Description

Expected behavior

Laravel should send cookies even without running optimize.

Observed behavior

Cookies are not present until php artisan optimize is run.

Notes

This only happens in a production; local dev does not reproduce.

Steps To Reproduce

1. Build image without running php artisan optimize
2. Start container
3. Make a request that should set session/cookie
4. Observe no Set-Cookie header

[marius-ciclistu]

Can you please share how are you setting the session cookie? This issue will be converted to discussion or closed due to version 10 not being supported. But I want to fix this if possible in v10.

[yudhees]

Thanks for looking into this.

I am not manually setting any cookies at all — I’m using Laravel’s default behavior. I’ve noticed that Laravel attempts to send session/cookie headers on every request by default (e.g., session cookie, CSRF cookie), but in my case those headers do not appear unless php artisan optimize has been run.

Also, when I return a plain array from a controller, Laravel does not automatically set the response as application/json and instead the browser treats it as text/html. So:
I’m not adding cookies myself; Laravel’s default middleware should handle them.
Cookies aren’t being sent in the response unless the app is optimized.
Returning an array does not result in a JSON response — Laravel should convert arrays to JSON responses by default, but it isn’t happening here.
This means two separate problems:
Missing Set-Cookie/Session headers without optimization.
Responses returned as arrays aren’t being formatted with JSON content type automatically.
Both behaviors seem unexpected compared to default Laravel behavior.

[marius-ciclistu]

Controllers must return Responces or Views not arrays. On Json response no cookie should be sent. Cookies are for view responses from web.php not for json responses from api.php.

[yudhees]

We are observing this issue even with a very minimal setup.
The route is defined only in routes/web.php and simply returns an array.
By default, Laravel should automatically serialize this into a JSON response with application/json.

However, without running php artisan optimize, the response is returned as HTML instead of JSON.
Once php artisan optimize is executed, the same route immediately starts returning proper JSON.

This makes php artisan optimize behave like a functional requirement rather than an optional performance optimization.
Core response behavior should not change based on whether optimization caches exist, and the application should behave correctly on a fresh deployment without requiring this command.

Route::get('/debug', function () {
    return [
        'success' => true,
        'message' => 'Debug',
    ];
});

[marius-ciclistu]

Ok. This is a diferent issue.
php artisan optimize is deprecated from my knowledge.
What you are describing could have to do with the request Accept header. If that is application/json then the response may be converted to json. Please try.

[marius-ciclistu]

Coming back to your first issue. Can you try php artisan config:cache instead of optimize and confirm the issue persists?

[rodrigopedra]

@yudhees I cannot reproduce the issue.

Please check a sample repository at:

https://github.com/rodrigopedra/issue-58193

The Readme file has installation and usage instructions.

[yudhees]

@rodrigopedra @marius-ciclistu

Yes, that's the issue not getting from local and also other Laravel projects even the same project in QA version

issue getting on dev version server only

once i run "php artisan optimzie" issue gone and will get cookie with laravel default headers
but if I clear "optimize" cookie not set in response and laravel default headers missing getting reponse in text/html

event i hosted on another ec2 instance getting same

[rodrigopedra]

It seems to be some configuration specific to your project.

Just to reiterate, the repository I linked above has the code for Laravel 10.

Also, both the route returning an array work as expected (converting the array to JSON), and the cookies are sent as expected, without the need to run any additional command such as php artisan optimize

If we cannot replicate the issue locally, it is almost impossible to offer help.

I would check for any packages or configurations that depend on the APP_DEBUG environment variable's value.