[7.x] Ability to skip a middleware from route registration

[dsazup]

Hello. Quite a few times I needed to skip a specific middleware for just one route. The current approach seems to be $except property in the middleware and then skipping it if the URL matches. This mostly works, but sometimes we do not know the exact URL, or we do not know the name of the route so that is not always the best solution.

I would like to propose skipMiddleware method, which would be used like:

• Route::get('/something')->skipMiddleware(VerifyCsrfToken::class)
• Route::get('/teams/create')->skipMiddleware(VerifyUserHasTeam::class)

Quite simple, but solves an annoying problem. Hopefully, I am not the only one running into this so I'd love to see this in the core. Please consider it and let me know if there is anything I need to change.

Thanks!

[taylorotwell]

Did you try this with the new route caching system? Does it still work?

[dsazup]

I just tried it, and it seems to work. Not the most useful example, but I tested with this in web.php

Route::middleware('auth')->group(function () {
    Route::get('/', [HomeController::class, 'index'])->skipMiddleware(Authenticate::class);
});

after running artisan route:cache command routes-v7.php contains:

and sure enough if I visit that route without being authenticated it works (i.e middleware is skipped successfully). I'm not sure if I should add a separate test for it?

[taylorotwell]

Looks like it is probably covered under the action being serialized.

[taylorotwell]

Fixed a small issue to resolve short alias names to class names before the exclusion check. Thanks.

[dsazup]

Awesome, thanks!

[driesvints]

@dsazup was it intentional that this doesn't applies to global middleware?

[dsazup]

Hey @driesvints, not really. I didn't realize the global middleware is being applied elsewhere, but now I see it happens in the http kernel. It would be really good to get it to work with global middleware though. 🤔

[driesvints]

@dsazup cool. Could you send in a PR for that? Here's a related issue: #32384

[decadence]

Is this renamed to withoutMiddleware?

[driesvints]

@decadence yes.

[Claw-Hammer]

I just tried this and didn't worked for me, i did tried with ->skipMiddleware(VerifyCsrfToken::class), and with ->withoutMiddleware(VerifyCsrfToken::class).... and nothing

[BrandonSurowiec]

@Claw-Hammer This doesn't support excluding global middleware: #32404