Hi,
Client flagged this one and I have confirmed.
The (potentially sensitive, hence the use of this module) content of the protected pages is plainly visible to curl before the 302 redirect kicks in.
Reproduce:
Action: Visit https://mydrupalsite/protected-url in browser
Result: 302 redirect occurs as normal (confirm in devtools), redirected to password input page
Action: Enter curl https://mydrupalsite/protected-url in terminal and inspect output
Result: Full page source of "protected" page clearly visible and accessible
Needs review
1.4
Code
Add a return checkProtectedPage() method and send a HTTP_NO_CONTENT in response fixed the problem, please review.