Laravel broadcast private channel can be subscribe by Echo::channel()

[nogamenofun98]

• Laravel Version: 8.61.0
• PHP Version: 8.0.8
• Database Driver & Version: 8.0.21

Description:

I had defined the channel route in routes/channel.php

When the frontend using laravel echo to subscribe to the channel, if I use Echo.private(), then it will call "/broadcasting/auth" api to get the token, and if I didnt pass the auth header in Echo there, it will show authentication failed. However, if I call Echo.channel() to subscribe to the same private channel, it just directly show "pusher_internal:subscription_succeeded" in the message, meaning it is successfully subscribe to the private channel without need to authentication using the auth headers, but it supposingly should show authentication error.

Steps To Reproduce:

1. Create a private channel route in routes/channel.php
2. Use Echo.channel() to subscribe to the channel, and it will show subscribe success.