OAuth2Authenticator should only support Bearer authorizations

Author: yoshz

src/Security/Authenticator/OAuth2Authenticator.php

@@ -64,7 +64,7 @@ public function __construct(
 
     public function supports(Request $request): ?bool
     {
-        return null;
+        return 0 === strpos($request->headers->get('Authorization', ''), 'Bearer ');
     }
 
     public function start(Request $request, AuthenticationException $authException = null): Response

tests/Acceptance/SecurityLayerTest.php

@@ -149,7 +149,7 @@ public function testInvalidRequest(): void
 
         $response = $this->client->getResponse();
 
-        $this->assertSame(401, $response->getStatusCode());
-        $this->assertSame('Bearer', $response->headers->get('WWW-Authenticate'));
+        $this->assertSame(200, $response->getStatusCode());
+        $this->assertSame('Hello, guest', $response->getContent());
     }
 }

tests/Fixtures/SecurityTestController.php

@@ -28,7 +28,7 @@ public function helloAction(): Response
         $user = $this->getUser();
 
         return new Response(
-            sprintf('Hello, %s', $user instanceof NullUser ? 'guest' : (method_exists($user, 'getUserIdentifier') ? $user->getUserIdentifier() : $user->getUsername()))
+            sprintf('Hello, %s', null === $user || $user instanceof NullUser ? 'guest' : (method_exists($user, 'getUserIdentifier') ? $user->getUserIdentifier() : $user->getUsername()))
         );
     }
 

tests/Integration/AuthorizationServerTest.php

@@ -312,7 +312,6 @@ public function testInvalidCredentialsPasswordGrant(): void
 
         $response = $this->handleTokenRequest($request);
 
-        // Response assertions.
         $this->assertSame('invalid_grant', $response['error']);
     }