Security context

Highlights

Timing Attack: 2 prior fixes. Scrutinize any change in this area.

src/Http/Middleware/VerifyCsrfToken.php: most-fixed (2 issues). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Timing Attack: Two separate fixes were needed to replace non-constant-time token comparisons, showing a repeated failure to use timing-safe equality checks.

Session Fixation: Attaching the session to a redirect response can allow an attacker to fixate a session; the fix removed this attachment.