CakePHP Authentication

CakePHP Authentication is a framework-agnostic authentication plugin built around PSR-7 middleware. It separates the two concerns of authentication cleanly: authenticators decide how a request presents credentials (form login, session, cookie, token, JWT, HTTP Basic/Digest, environment), while identifiers decide how those credentials are resolved to a user (password lookup, token, JWT subject, LDAP, or a custom callback).

Though it integrates tightly with CakePHP through its plugin, middleware, and controller components, the core AuthenticationService works in any PSR-7 application. Authenticators and identifiers are collections you configure and stack, making it straightforward to support multiple login mechanisms side by side and to add impersonation, stateless APIs, or session-based flows.

What You Get

• An AuthenticationService and PSR-7 AuthenticationMiddleware that orchestrate the auth flow
• Built-in authenticators: Form, Session, Cookie, Token, JWT, HTTP Basic/Digest, and Environment
• Pluggable identifiers: Password, Token, JWT subject, LDAP, and Callback resolvers
• An Identity object and IdentityInterface for accessing the authenticated user
• Impersonation, stateless, and persistence interfaces for advanced flows

Common Use Cases

• Adding session- and form-based login to a CakePHP web application
• Securing a stateless API with token or JWT authentication
• Supporting multiple login methods (form plus remember-me cookie plus API token) in one app

Under The Hood

Architecture — The core is AuthenticationService (implementing AuthenticationServiceInterface), which holds an AuthenticatorCollection and an IdentifierCollection, both extending AbstractCollection. On each request the AuthenticationMiddleware (src/Middleware) invokes the service, which iterates authenticators (src/Authenticator: Form, Session, Cookie, Token, Jwt, HttpBasic, HttpDigest, Environment, PrimaryKeySession) until one returns a successful Result. The authenticator delegates credential resolution to identifiers (src/Identifier: Password, Token, JwtSubject, Ldap, Callback) which return the user, wrapped in an Identity implementing IdentityInterface. Cross-cutting interfaces — StatelessInterface, PersistenceInterface, ImpersonationInterface — let authenticators declare their behavior to the service.

Tech Stack — PHP >=8.1, depending on cakephp/http and cakephp/utility (^5.0) plus laminas/laminas-diactoros and the PSR HTTP interfaces (psr/http-message, psr/http-server-handler, psr/http-server-middleware, psr/http-client). Building on PSR-7/PSR-15 is what makes the plugin usable outside CakePHP.

Code Quality — The src/ tree is interface-first, with abstract bases (AbstractAuthenticator, AbstractIdentifier, AbstractCollection) sharing behavior and a dedicated set of typed exceptions (UnauthenticatedException, AuthenticationRequiredException, MissingIdentifierException). A broad test suite under tests/TestCase/ covers the service, middleware, and individual authenticators and identifiers.

API Design — Configuration is declarative: you load authenticators and identifiers by name with an options array, and the service handles the request/response lifecycle. The clean split between “how credentials arrive” (authenticators) and “how they map to a user” (identifiers) is the library’s central design idea and keeps each piece independently swappable.