Request Data & Replies

Queued cookies are copied onto responses by AddQueuedCookiesToResponse, which is in the web group but not the api group. withCookie() comes from Laravel's ResponseTrait, which Symfony's BinaryFileResponse returned by download() does not use.

Laravel loads the session when a request starts and writes the whole payload back at the end, unlocked, so the later of two overlapping requests overwrites the other's change. ->block() on the routes serialises them with a per-session cache lock.

A streamed response's callback runs during send(), after the HTTP kernel and all middleware, including StartSession's save, have finished. Session changes made there are never persisted, and an exception cannot change the already-sent 200 status.

Stream with streamDownload() when the export finishes within about a minute and the user waits for it. Queue a job that writes the file to a disk and sends a link when it runs longer, must survive failures, or many users export at once.

A body over post_max_size is stopped by the global ValidatePostSize middleware with a 413 PostTooLargeException. A file over upload_max_filesize but inside post_max_size reaches the controller as an invalid UploadedFile, and validation reports it as failed to upload.

Response::macro('name', fn) adds a method to the response factory, so response()->name(...) builds the shared shape anywhere. A Responsable class implements toResponse($request), and the router calls it when a controller returns that object.

With 'serialization' => 'json', the session payload is json_encode'd, so objects such as models or value objects come back as plain arrays. It removes PHP unserialize() from the session path; switching an existing app from php invalidates every active session.