Laravel 9 password.confirm middleware feature not working

I am trying to use the password.confirm middleware in some of my routes which I need to be secured. I want a user should confirm his password when he generate a specific post request.

Also, password.confirm middleware is added $routeMiddleware property in the app/Http/Kernel.php file.

This is what my route looks like in web.php.

Route::post('fetchResult', [ReportController::class, 'fetchResult'])->name('fetchComplaintResult')->middleware('password.confirm');

But it is not working. When I generate post request it directly hit to controller fetchResult method as usual.

My controller function:

public function fetchResult(Request $request)
{
        Model::create([
            'id' => $request->id,
            'action' => $request->action,
            'comments' => $request->comment
        ]);
       // Other Action
}

Am I missing something ??

If you want to get prompted to confirm your password every time you should write your route like this:

Route::post('fetchResult', [ReportController::class, 'fetchResult'])
    ->name('fetchComplaintResult')
    ->middleware('password.confirm:password.confirm,1');

Why?

The password.confirm middleware maps to the Illuminate\Auth\Middleware\RequirePassword class. This is its code.

use Closure;
use Illuminate\Contracts\Routing\ResponseFactory;
use Illuminate\Contracts\Routing\UrlGenerator;

class RequirePassword
{
    /**
     * The response factory instance.
     *
     * @var \Illuminate\Contracts\Routing\ResponseFactory
     */
    protected $responseFactory;

    /**
     * The URL generator instance.
     *
     * @var \Illuminate\Contracts\Routing\UrlGenerator
     */
    protected $urlGenerator;

    /**
     * The password timeout.
     *
     * @var int
     */
    protected $passwordTimeout;

    /**
     * Create a new middleware instance.
     *
     * @param  \Illuminate\Contracts\Routing\ResponseFactory  $responseFactory
     * @param  \Illuminate\Contracts\Routing\UrlGenerator  $urlGenerator
     * @param  int|null  $passwordTimeout
     * @return void
     */
    public function __construct(ResponseFactory $responseFactory, UrlGenerator $urlGenerator, $passwordTimeout = null)
    {
        $this->responseFactory = $responseFactory;
        $this->urlGenerator = $urlGenerator;
        $this->passwordTimeout = $passwordTimeout ?: 10800;
    }

    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @param  string|null  $redirectToRoute
     * @param  int|null  $passwordTimeoutSeconds
     * @return mixed
     */
    public function handle($request, Closure $next, $redirectToRoute = null, $passwordTimeoutSeconds = null)
    {
        if ($this->shouldConfirmPassword($request, $passwordTimeoutSeconds)) {
            if ($request->expectsJson()) {
                return $this->responseFactory->json([
                    'message' => 'Password confirmation required.',
                ], 423);
            }

            return $this->responseFactory->redirectGuest(
                $this->urlGenerator->route($redirectToRoute ?? 'password.confirm')
            );
        }

        return $next($request);
    }

    /**
     * Determine if the confirmation timeout has expired.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  int|null  $passwordTimeoutSeconds
     * @return bool
     */
    protected function shouldConfirmPassword($request, $passwordTimeoutSeconds = null)
    {
        $confirmedAt = time() - $request->session()->get('auth.password_confirmed_at', 0);

        return $confirmedAt > ($passwordTimeoutSeconds ?? $this->passwordTimeout);
    }
}

The important parts to note are the handle method's signature:

public function handle($request, Closure $next, $redirectToRoute = null, $passwordTimeoutSeconds = null)

Here, $redirectToRoute and $passwordTimeoutSeconds are arguments we can set in the route file.

$redirectToRoute is used like this in the handle method:

$this->urlGenerator->route($redirectToRoute ?? 'password.confirm')

$passwordTimeoutSeconds is used here in the shouldConfirmPassword method.

return $confirmedAt > ($passwordTimeoutSeconds ?? $this->passwordTimeout);

Since it's set to null, the value $confirmedAt is compared to is $this->passwordTimeout, which is set in the constructor to 10800. (10800 seconds = 180 minutes = 3 hours).

So in summary we need to set the $passwordTimeoutSeconds parameter. Since it's the second parameter, we also need to set the $redirectToRoute parameter.

https://laravel.com/docs/9.x/middleware#middleware-parameters