Ahnii!

A login helper can verify the right password and still bypass part of your authentication policy.

This happens when application code constructs an authentication manager directly. The new object may have access to credentials, but it does not automatically inherit the eligibility checks, password-upgrade service, session rules, or principal factory configured in your container.

A recent Anokii authentication repair shows how to put those decisions back behind framework-owned services. The same boundary applies to any PHP application with configurable authentication policy.

Authentication managers carry policy

It is easy to mistake an authentication manager for a utility class. Give it a user reader, call authenticate() , and you have a password check.

But password verification is only one part of login.…