How to get rid of laravel_session cookie from Laravel application?

Question

I'm trying to get rid of laravel_session.

I've tried to create a middleware for it

https://laracasts.com/discuss/channels/laravel/laravel-51-disable-session-and-cookies-for-some-routes

Change the driver to use : array file, database

None of that works. Every time I refresh, I always see this:

How can I achieve this? Is it even possible to do ?

Answer 1

If you don't want to start a session at all, in Laravel 5.1 go to app/Http/Kernel.php and comment out the session-related parts:

protected $middleware = [
    \Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode::class,
    \App\Http\Middleware\EncryptCookies::class,
    \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
    // \Illuminate\Session\Middleware\StartSession::class,
    // \Illuminate\View\Middleware\ShareErrorsFromSession::class,
    // \App\Http\Middleware\VerifyCsrfToken::class,
];

Note that it's not sufficient to only rip out the StartSession middleware, you'll also have to disable ShareErrorsFromSession and VerifyCsrfToken since they rely on a session being present. If you want more logic like excluding it for certain routes, you could override the StartSession middelware. I don't know of any other side effects though because I haven't tested it.

If you don't need sessions or all the website related functions because, for instance, you're only building an API, you might want to have a look at Laravel Lumen that is streamlined for this purpose.

And by the way: The session driver only defines where/how to store the session server-side. From the client side it's still just an encrypted cookie.

Answer 2

If I have specific routes that I don't want Laravel to use laravel_session. You can apply that to any routes you want.

Ex. For example, if you want to apply to only these 2 routes :

url1 or url2

Route::get('/url1', 'SampleController@fnName');

Route::get('/url2', 'SampleController@fnName2');

---

Create /app/Http/Middleware/StartSessionMiddleware.php

<?php
namespace App\Http\Middleware;

use Closure;
use Config;

use Illuminate\Session\Middleware\StartSession as BaseStartSession;

class StartSessionMiddleware extends BaseStartSession
{

    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next) {

        if($request->is('url1') || $request->is('url2')) {
            Config::set('session.driver', 'array');
        }

        return parent::handle($request, $next);
    }
}

Register that by appending a line into /app/Http/Kernel.php

\App\Http\Middleware\StartSessionMiddleware::class,

and now, that laravel_session should not be there anymore for those 2 routes.

I hope this can help someone.