Security context

Highlights

Auth Bypass: 5 prior fixes. Scrutinize any change in this area.

src/Auth/BasicProvider.php: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: Two separate fixes address null responses from onceBasic being treated as valid, allowing unauthenticated access. The first changed the condition to require a non-null response with a 401 status, and the second added a null check before calling getStatusCode().

Auth Bypass: Scope validation was performed before token validation and used the resource's scopes instead of the token's, allowing tokens with insufficient scopes to pass. The fix moved scope validation after token validation and used token->hasScope.

Auth Bypass: OAuth token validation was not enforced as a before filter, allowing protected routes to process requests with invalid tokens. The fix introduced an authorize() method and moved validation to a before filter.