CSRF breaks Auth on dynamic routes

[timclutton]

There seems to be an incompatibility between leafs/csrf and leafs/auth that causes authentication middleware not to run when using dynamic routing.

A minimal example:

require __DIR__ . '/vendor/autoload.php';

auth()->middleware('auth.required', function () {
    response()->exit(['unauthorised'], 401);
});

app()->get('/secure', [
    'middleware' => 'auth.required',
    function () {
        response()->json(['message' => 'Hello World!']);
    }
]);

app()->get('/{insecure}', [
    'middleware' => 'auth.required',
    function ($insecure) {
        response()->json(['message' => "Uh oh!"]);
    }
]);

app()->csrf();

app()->run();

Using the above, a GET call to /secure will return a 401 error as expected.

But a GET call to /insecure (or since it's dynamic, anything that isn't /secure) will unexpectedly return:

{"message":"Uh oh!"}

Simply commenting out, or removing, the line app()->csrf() and repeating the GET call to /insecure will return a 401 error as expected.

Versions in use:

• leafs/auth: 3.0.3
• leafs/csrf: 0.5.3
• leafs/leaf: 3.8