title: Laravel 5.4 API route 302 with Tymon JWT middleware
body: <p>I'm trying to do a simple test with a route on the API.php file using <a href="https://github.com/tymondesigns/jwt-auth" rel="nofollow noreferrer">Tymon JWT</a> package:</p>
  
  <pre><code>Route::group(['middleware' =&gt; [ 'jwt.auth' ] ], function ()
  {
    Route::group(['prefix' =&gt; 'auth', 'namespace' =&gt; 'Auth'], function () {
        Route::post('get-user')
          -&gt;name('auth.get_user')
          -&gt;uses('LoginController@getAuthenticatedUser');
    });
  });
  </code></pre>
  
  <p><strong>LoginController@getAuthenticatedUser</strong> is as follows:</p>
  
  <pre><code>// Get authenticated user
  public function getAuthenticatedUser()
  {
      try {
  
        if (! $user = JWTAuth::parseToken()-&gt;authenticate()) {
          return response()-&gt;json(['user_not_found'], 404);
        }
  
      } catch (Tymon\JWTAuth\Exceptions\TokenExpiredException $e) {
  
          return response()-&gt;json(['token_expired'], $e-&gt;getStatusCode());
  
      } catch (Tymon\JWTAuth\Exceptions\TokenInvalidException $e) {
  
          return response()-&gt;json(['token_invalid'], $e-&gt;getStatusCode());
  
      } catch (Tymon\JWTAuth\Exceptions\JWTException $e) {
  
          return response()-&gt;json(['token_absent'], $e-&gt;getStatusCode());
  
      }
  
      // the token is valid and we have found the user via the sub claim
      return response()-&gt;json(compact('user'));
  }
  </code></pre>
  
  <p>I've tested the code and my conclusion, which I think is wrong, is that on the package's middleware if I grab the $user I get a 302 status on the route, otherwise everything goes nicely:</p>
  
  <pre><code>public function handle($request, \Closure $next)
  {
      if (! $token = $this-&gt;auth-&gt;setRequest($request)-&gt;getToken()) {
          return $this-&gt;respond('tymon.jwt.absent', 'token_not_provided', 400);
      }
  
      try {
          $user = $this-&gt;auth-&gt;authenticate($token);
      } catch (TokenExpiredException $e) {
          return $this-&gt;respond('tymon.jwt.expired', 'token_expired', $e-&gt;getStatusCode(), [$e]);
      } catch (JWTException $e) {
          return $this-&gt;respond('tymon.jwt.invalid', 'token_invalid', $e-&gt;getStatusCode(), [$e]);
      }
  
      if (! $user) {
          return $this-&gt;respond('tymon.jwt.user_not_found', 'user_not_found', 404);
      }
  
      $this-&gt;events-&gt;fire('tymon.jwt.valid', $user);
  
      return $next($request);
  }
  </code></pre>
  
  <p>I am sending the JWT correctly. I can prove this by logging the $user variable in the code above and checking the data is correct.</p>
  
  <p>This is the Http/Kernel:</p>
  
  <pre><code>&lt;?php
  
  namespace App\Http;
  
  use Illuminate\Foundation\Http\Kernel as HttpKernel;
  
  class Kernel extends HttpKernel
  {
          /**
           * The application's global HTTP middleware stack.
           *
           * These middleware are run during every request to your application.
           *
           * @var array
           */
          protected $middleware = [
                  \Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode::class,
                  \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
                  \App\Http\Middleware\TrimStrings::class,
                  \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
          ];
  
          /**
           * The application's route middleware groups.
           *
           * @var array
           */
          protected $middlewareGroups = [
                  'web' =&gt; [
                          \App\Http\Middleware\EncryptCookies::class,
                          \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
                          \Illuminate\Session\Middleware\StartSession::class,
                          \Illuminate\Session\Middleware\AuthenticateSession::class,
                          \Illuminate\View\Middleware\ShareErrorsFromSession::class,
                          \App\Http\Middleware\VerifyCsrfToken::class,
                          \Illuminate\Routing\Middleware\SubstituteBindings::class,
                  ],
  
                  'api' =&gt; [
                          'throttle:60,1',
                          'bindings',
                  ],
          ];
  
          /**
           * The application's route middleware.
           *
           * These middleware may be assigned to groups or used individually.
           *
           * @var array
           */
          protected $routeMiddleware = [
                  'auth' =&gt; \Illuminate\Auth\Middleware\Authenticate::class,
                  'auth.basic' =&gt; \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
                  'bindings' =&gt; \Illuminate\Routing\Middleware\SubstituteBindings::class,
                  'can' =&gt; \Illuminate\Auth\Middleware\Authorize::class,
                  'guest' =&gt; \App\Http\Middleware\RedirectIfAuthenticated::class,
                  'throttle' =&gt; \Illuminate\Routing\Middleware\ThrottleRequests::class,
  
                  'jwt.auth' =&gt; \Tymon\JWTAuth\Middleware\GetUserFromToken::class,
                  'jwt.refresh' =&gt; \Tymon\JWTAuth\Middleware\RefreshToken::class,
          ];
  }
  </code></pre>
  
  <p>Below is a screenshot of the route:<a href="https://i.stack.imgur.com/yCTVp.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/yCTVp.png" alt="enter image description here"></a></p>
  
  <p>I don't know where to turn next, any ideas? </p>