Laravel request being routed through wrong middleware - php

Question

I want to add a http response header to all my responses on my app. I've just created a new middleware in order to do this as follows:
namespace Ibbr\Http\Middleware;
use Closure;
class XFrameOptionsHeader
{
public function handle($request, Closure $next)
{
$response = $next($request);
$response->header('X-Frame-Options', 'deny');
return $response;
}
}
Then, added it to my Kernel.php
protected $middlewareGroups = [
'web' => [
\Ibbr\Http\Middleware\EncryptCookies::class,
\Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
\Illuminate\Session\Middleware\StartSession::class,
// \Illuminate\Session\Middleware\AuthenticateSession::class,
\Illuminate\View\Middleware\ShareErrorsFromSession::class,
\Ibbr\Http\Middleware\VerifyCsrfToken::class,
\Ibbr\Http\Middleware\XFrameOptionsHeader::class,
\Illuminate\Routing\Middleware\SubstituteBindings::class,
],
protected $routeMiddleware = [
'auth' => \Illuminate\Auth\Middleware\Authenticate::class,
'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
'bindings' => \Illuminate\Routing\Middleware\SubstituteBindings::class,
'can' => \Illuminate\Auth\Middleware\Authorize::class,
'guest' => \Ibbr\Http\Middleware\RedirectIfAuthenticated::class,
'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
'verificaCookieArquivo' => \Ibbr\Http\Middleware\VerificaCookieArquivo::class,
'xFrameOptionsHeader' => \Ibbr\Http\Middleware\XFrameOptionsHeader::class,
]
and in the routes definition I have:
Route::group(['middleware'=>['verificaCookieArquivo']], function(){
Route::get('/storage/{filename}', 'PagesController#getArquivo');
});
Route::group(['middleware'=>['web','xFrameOptionsHeader']], function(){
Route::get('/', 'PagesController#getIndex');
// more routes...
});
Whenever I call any route in the second group ['web','xFrameOptionsHeader'] it works normally and return the new http header. But, when I call the route /storage/{filename} it fails with the error
Call to undefined method
Symfony\Component\HttpFoundation\BinaryFileResponse::header()
So first of all before considering if the header function exists or not in this context, I find it more strange that this middleware is even being called in this situation where I thought that it would call only the verificaCookieArquivo mid. Why does this happen and how to solve? Btw, I'm using laravel-5.7 but thre's not tag for it.

Answer 1

just remove \Ibbr\Http\Middleware\XFrameOptionsHeader::class, from your web middleware groups.
web middleware group is automatically applied to routes/web.php. Thus that's why the middleware is ran on:
Route::group(['middleware'=>['verificaCookieArquivo']], function(){
Route::get('/storage/{filename}', 'PagesController#getArquivo');
});
Moreover, you do not need to specify web in your next route group as well:
Route::group(['middleware'=>['web','xFrameOptionsHeader']], function(){
// ^-- Remove this
Route::get('/', 'PagesController#getIndex');
// more routes...
});
Reference: https://laravel.com/docs/5.6/middleware#middleware-groups