Laravel 5.2 middleware groups replaced the kernel list

Before 5.2 the HTTP kernel had one global middleware stack, so anything needed by web routes also ran for API routes — sessions, CSRF verification and cookie encryption on a stateless JSON endpoint.

protected $middlewareGroups = [
    'web' => [
        EncryptCookies::class,
        StartSession::class,
        VerifyCsrfToken::class,
    ],
    'api' => [
        'throttle:60,1',
    ],
];

Route::group(['middleware' => 'api', 'prefix' => 'api'], function () { /* ... */ });

The practical win is that an API route stops starting a session for every request, which on a token-authenticated endpoint is a wasted read and write per call. The trap during the upgrade is that routes outside a group now get no middleware at all rather than the old global stack — so a route file that was relying on the implicit behaviour silently loses CSRF protection.