laravel/framework — pull request #5732 by franzliedke (2014-09-14 17:23:54+00:00)
Title: Remove hardcoded middlewares

This goes back to issue #3440 (for anybody with access to the GitHub database, hehe).

The original problem: Cookies will always be encrypted, which is fine until you want to do either of these things:
* access cookies from other applications (which means you'll have to use the `$_COOKIE` superglobal, yuck)
* share a cookie with a JS frontend

At the core of the problem was the old `getStackedClient()` method, which had some middlewares hardcoded. One of them was `Illuminate\Cookie\Guard`, which encrypts all the cookies. Yay!

Making them configurable (or at least removable, using the `forgetMiddleware()` method) would mean using the `middleware()` method to register them.

We could do that in the application class (best place: right before service providers are booted). Or we could move it to service providers, which is what I did now.

Another problem arises when we go that way: the order of the middleware matters, the guard middleware has to be first, because it encrypts all the cookies. Both of the other ones set cookies. This is no problem for the cookie queue, but for the session middleware I can only guarantee the order by making sure the session service provider is booted after the cookie service provider (which happens to be the case in laravel/laravel right now). Thus: not a good solution.

An old proposal by @leesherwood was to make the middlewares configurable (just like service providers and facades), that might be an easy solution.

Regarding the original discussion and not encrypting cookies: we may have to add a flag or another class for un-encrypted cookies. But that's another discussion...