Session

Authentication session middleware for protected routes.

class Session implements \Hazaar\Middleware\Interface\Middleware , \Hazaar\Middleware\Interface\Terminable

Implements: Hazaar\Middleware\Interface\Middleware, Hazaar\Middleware\Interface\Terminable

This middleware extracts an auth token from the configured transport, loads session data from the configured backend, and injects the resolved session payload into the request attributes under session.

Behavior:

• Valid token: forwards the request to the next handler.
• Missing/invalid/expired token: tries the refresh token, if there is one. If that fails too, returns 401 Unauthorized unless optional mode is enabled.

Optional mode can be enabled via variadic handler args ($args[1] === true), allowing requests without valid auth to continue. The refresh token is still used in optional mode, so a signed-in user whose access token has expired is still signed in on optional routes.

Properties

adapter

Authentication adapter providing backend and transport integrations.

private Adapter $adapter

Type: Hazaar\Auth\Adapter

Methods

__construct

Creates session auth middleware.

public __construct(Adapter $adapter): void

Parameters

Parameter	Type	Description
$adapter	Hazaar\Auth\Adapter	auth adapter used to extract/load session tokens

handle

Handles request authentication using token-backed session lookup.

public handle(Request $request, callable $next, mixed $args): Response

Returns: Hazaar\Controller\Response

Parameters

Parameter	Type	Description
$request	Hazaar\Application\Request	incoming application request
$next	callable	next middleware/controller handler
$args	mixed

shutdown

public shutdown(Request $request, ?Response $response): void

Returns: void

Parameters

Parameter	Type	Description
$request	Hazaar\Application\Request
$response	Hazaar\Controller\Response

---

Generated by Hazaar API Doc Generator on Thu, 22 Oct 2026 05:05:29 +0000