Repository navigation
Bug: auth.required middleware is not triggered on dynamic routes within app()->group() #327
Description
I'm re-issuing this issue as it was not picked up (maybe not seen) in the leafsphp/auth repository. It's about the following issue: leafsphp/auth#32
This is a critical issue as it opens a huge security hole!
Activity
fix: run group middleware on dynamic routes when a catch-all middlewa…
fix: run group middleware on dynamic routes when a catch-all middlewa…
mychidarko commentedon Oct 17, 2026
Thanks for the report, and sorry this sat for a while. This is fixed: v5 has had the fix since release (regression tests in tests/middleware.test.php reference #316 and #327), and it's now backported to v4.x (#335) and v3.x (#336), with patch releases on both branches. If you're still on Leaf 4, update to the latest v4 tag and it should go away. Related: #334 also fixed named middleware registered after routes being silently dropped. Reopen if you still hit it.