ensure auth0 middleware is prioritized to load before others

[squpshift]

Changes

Ensure auth0 middleware is prioritized to load before other middleware that expect auth to have been completed, such as middleware for Laravel Inetrtia, Laravel Nova.

References

Fixes #414

[evansims]

Hi @squpshift 👋 Thanks for your suggestion.

This is not an acceptable change because if you review the middleware priorities in the app/Http/Kernel.php file:

protected $middlewarePriority = [
    \Illuminate\Foundation\Http\Middleware\HandlePrecognitiveRequests::class,
    \Illuminate\Cookie\Middleware\EncryptCookies::class,
    \Illuminate\Session\Middleware\StartSession::class,
    \Illuminate\View\Middleware\ShareErrorsFromSession::class,
    \Illuminate\Contracts\Auth\Middleware\AuthenticatesRequests::class,
    \Illuminate\Routing\Middleware\ThrottleRequests::class,
    \Illuminate\Routing\Middleware\ThrottleRequestsWithRedis::class,
    \Illuminate\Contracts\Session\Middleware\AuthenticatesSessions::class,
    \Illuminate\Routing\Middleware\SubstituteBindings::class,
    \Illuminate\Auth\Middleware\Authorize::class,
];

And evaluate this against the default middleware groups themselves:

protected $middlewareGroups = [
    'web' => [
        \App\Http\Middleware\EncryptCookies::class,
        \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
        \Illuminate\Session\Middleware\StartSession::class,
        \Illuminate\View\Middleware\ShareErrorsFromSession::class,
        \App\Http\Middleware\VerifyCsrfToken::class,
        \Illuminate\Routing\Middleware\SubstituteBindings::class,
    ],
 
    'api' => [
        \Illuminate\Routing\Middleware\ThrottleRequests::class.':api',
        \Illuminate\Routing\Middleware\SubstituteBindings::class,
    ],
];

For web, this means AuthenticatorMiddleware would run before sessions are established, CSRF tokens are verified, and cookies are decrypted — this would be problematic for obvious reasons.

For api, this means AuthorizerMiddleware would run before network requests are checked for throttling, which opens applications up to denial of service attacks.

This is why this behavior is not implemented in the SDK in the first place.

Thank you for your suggestion, but we'll need to find alternative ways of addressing this.