Merge pull request #626 from beyondcode/fix/check-app-key

[fix] Check for key app on authorization

Author: rennokki

src/Statistics/Http/Middleware/Authorize.php

@@ -8,6 +8,10 @@ class Authorize
 {
     public function handle($request, $next)
     {
-        return is_null(App::findBySecret($request->secret)) ? abort(403) : $next($request);
+        $app = App::findByKey($request->key);
+
+        return is_null($app) || $app->secret !== $request->secret
+            ? abort(403)
+            : $next($request);
     }
 }

tests/Statistics/Controllers/WebSocketsStatisticsControllerTest.php

@@ -14,6 +14,7 @@ public function it_can_store_statistics()
         $this->post(
             action([WebSocketStatisticsEntriesController::class, 'store']),
             array_merge($this->payload(), [
+                'key' => config('websockets.apps.0.key'),
                 'secret' => config('websockets.apps.0.secret'),
             ])
         );