PHP Authentication Security

Preferred Authentication Stack

For compatible PSR-7 and PSR-15 applications, prefer mezzio/mezzio-authentication and its maintained adapters. For form login backed by a server-side session, prefer mezzio/mezzio-authentication-session and the project's established Mezzio session adapter.

• Do not build a replacement authentication middleware, identity request attribute, or session adapter when the Mezzio components satisfy the requirement.
• Keep Mezzio interfaces, middleware, adapters, and session types in infrastructure and web composition.
• Map the authenticated Mezzio user to an application-owned CurrentUser before application code consumes it.
• Keep credential lookup, password verification, account state, and application identity mapping behind project-owned interfaces where the application has rules beyond the adapter contract.
• Use PHP's native password_hash(), password_verify(), and password_needs_rehash() APIs. Do not implement a password hashing algorithm.

Compose protected routes through the established middleware pipeline: