From a75782d576bc601bdc4d9f10e29feded319b0149 Mon Sep 17 00:00:00 2001
From: Amirhf1 <amirhacking85@gmail.com>
Date: Fri, 24 Jul 2026 18:36:53 +0330
Subject: [PATCH] Mark HTTP testing credentials as sensitive

---
 .../Testing/Concerns/MakesHttpRequests.php           |  4 ++--
 .../Testing/Concerns/MakesHttpRequestsTest.php       | 12 ++++++++++++
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/src/Illuminate/Foundation/Testing/Concerns/MakesHttpRequests.php b/src/Illuminate/Foundation/Testing/Concerns/MakesHttpRequests.php
index 8c7adc3b9921..be7fdd69fc5d 100644
--- a/src/Illuminate/Foundation/Testing/Concerns/MakesHttpRequests.php
+++ b/src/Illuminate/Foundation/Testing/Concerns/MakesHttpRequests.php
@@ -128,7 +128,7 @@ public function withoutHeaders(array $headers)
      * @param  string  $type
      * @return $this
      */
-    public function withToken(string $token, string $type = 'Bearer')
+    public function withToken(#[\SensitiveParameter] string $token, string $type = 'Bearer')
     {
         return $this->withHeader('Authorization', $type.' '.$token);
     }
@@ -140,7 +140,7 @@ public function withToken(string $token, string $type = 'Bearer')
      * @param  string  $password
      * @return $this
      */
-    public function withBasicAuth(string $username, string $password)
+    public function withBasicAuth(string $username, #[\SensitiveParameter] string $password)
     {
         return $this->withToken(base64_encode("$username:$password"), 'Basic');
     }
diff --git a/tests/Foundation/Testing/Concerns/MakesHttpRequestsTest.php b/tests/Foundation/Testing/Concerns/MakesHttpRequestsTest.php
index 1f5834afc3a6..43a10b7e0edb 100644
--- a/tests/Foundation/Testing/Concerns/MakesHttpRequestsTest.php
+++ b/tests/Foundation/Testing/Concerns/MakesHttpRequestsTest.php
@@ -5,9 +5,12 @@
 use Illuminate\Contracts\Routing\Registrar;
 use Illuminate\Contracts\Routing\UrlGenerator;
 use Illuminate\Foundation\Http\Middleware\HandlePrecognitiveRequests;
+use Illuminate\Foundation\Testing\Concerns\MakesHttpRequests;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Orchestra\Testbench\TestCase;
+use ReflectionMethod;
+use SensitiveParameter;
 
 class MakesHttpRequestsTest extends TestCase
 {
@@ -85,6 +88,15 @@ public function testWithBasicAuthSetsAuthorizationHeader()
         $this->assertSame('Basic '.$callback($username, $password), $this->defaultHeaders['Authorization']);
     }
 
+    public function testAuthenticationCredentialsAreSensitiveParameters()
+    {
+        $token = (new ReflectionMethod(MakesHttpRequests::class, 'withToken'))->getParameters()[0];
+        $password = (new ReflectionMethod(MakesHttpRequests::class, 'withBasicAuth'))->getParameters()[1];
+
+        $this->assertCount(1, $token->getAttributes(SensitiveParameter::class));
+        $this->assertCount(1, $password->getAttributes(SensitiveParameter::class));
+    }
+
     public function testWithoutTokenRemovesAuthorizationHeader()
     {
         $this->withToken('foobar');