Skip to content

Conversation

@pascalbaljet
Copy link
Member

@pascalbaljet pascalbaljet commented Dec 19, 2025

On PUT/PATCH/DELETE requests, the Inertia middleware converts 302 redirects to 303. This ensures browsers use GET for the redirect target instead of reusing the original request method.

When middleware like ThrottleRequests returns a custom redirect response, it throws an HttpResponseException that bypasses any middleware further down the stack. Since the Inertia middleware typically runs late in the stack, it never gets a chance to convert the status code.

RateLimiter::for('api', function () {
    return Limit::perMinute(5)->response(fn () => back()->with('error', 'Too many requests.'));
});

Route::delete('posts/{post}', [PostController::class, 'destroy'])->middleware('throttle:api');

When rate limited, the browser receives a 302 and retries the DELETE request on the redirect target.

This PR registers Inertia\Middleware in Laravel's middleware priority list after StartSession, ensuring it runs before ThrottleRequests and other middleware that may throw redirect responses.

Laravel 10 and PHP 8.1 will be dropped in v3, hence the changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants