AuthMiddleware
in package
`HandlerStack` middleware: injects `Authorization` (current access token) and `X-Tenant-ID` on EVERY outgoing request, and `X-CSRF-Token` (captured from a prior response, {@see Session::csrfToken()}) on state-changing requests (CONTRACT.md §3 non-browser CSRF, §5 tenant context contract).
Registered on the HandlerStack closer to the base handler than
RefreshMiddleware, so a retried request (after a single-flight refresh) is
re-decorated with the FRESH access token / CSRF value picked up from the shared
Session — never the stale headers from the original 401'd attempt.
Table of Contents
Methods
- __construct() : mixed
- __invoke() : callable
- Wraps the next Guzzle handler, decorating same-origin requests with the tenant header, bearer token and — on state-changing methods (§3) — the `X-CSRF-Token` header.
Methods
__construct()
public
__construct(Session $session) : mixed
Parameters
- $session : Session
-
Session supplying the tenant, bearer token and CSRF token.
__invoke()
Wraps the next Guzzle handler, decorating same-origin requests with the tenant header, bearer token and — on state-changing methods (§3) — the `X-CSRF-Token` header.
public
__invoke(callable $handler) : callable
Cross-host requests (and cross-host redirects) are deliberately left undecorated so the credentials never leak to a third-party URL.
Parameters
- $handler : callable
-
Next handler in the Guzzle stack.
Return values
callable —Decorated handler.