RFC: Default sessionKey is not BC compatible about authentication HOT 3 CLOSED

This plugin is already not a drop in replacement, so I don't think this will be the breaking point. This plugin has no equivalent for Auth->allow() and Auth->deny() and I think we're all OK with that at this point.

from authentication.

This plugin works significantly differently than existing core AuthComponent so I don't think BC is a concern anyway. Plus it can be configured as you showed. So only thing to consider IMO is whether current default is good enough on it's own merit.

from authentication.

@ADmad I'm OK with both possibilities, but some in the core team are extremely concerned about users who don't read docs and migration guides and the users in question then come up crying why something is not working as expected. My perception is that we always try to make it easy, even for the lazy non-reading audience. That's why I want to discuss it here before making a change, either updating docs or the default config.

But I also think it's going to be a common case that you want to use the authentication plugin side by side with the old auth component as long as we don't have the authorization refactored as well. Authentication and authorization has been married in the AuthComponent, so I can't have authoriziation without the AuthComponent yet which is sadly coupled to the authentication.

from authentication.