Laravel middleware is "bypassed" when i submit the invalid token, but when it is a valid token, the middleware is executed

all my fellow friends, i have a question.

Route::group([
    'middleware' => ['ensure.role:store', 'auth:api']
]

For simplification,

i have two roles : ADMIN and STORE

I have created a middleware that will validate user role, and if the user role is correct, then will allow the user to access the route.

It works fine. I tried using ADMIN Jwt Token to access STORE routes, and rightfully i am kicked out, and vice versa.

But now, if i modify the token, lets say i add a string to any part of the token, and try to access any route, actually i am allowed to.

I tried var_dump and print something on the related middleware, and here are my observation.

1. If the token is VALID as one of the user role, then 
the var_dump is executed, (means the middleware is executed)
2. if the token is INVALID as in i add / modify the original
token, then the var_dump is not executed, and so are the 
others route middleware.

I am wondering what causes this behavior, and what could be the fix for this issue, as i need to throw 401 unauthenticated in any token invalid case.

Thank you

from Newest questions tagged laravel-5 - Stack Overflow http://bit.ly/2G8GePE
via IFTTT