Embedding Password Expiration in Custom Authenticate Subclass Versus beforeLogin Event in CakePHP

This question addresses where password expiration logic should be enforced in CakePHP's authentication layer when operating under least-privilege access constraints. The framework's Auth component provides default password hashing via Hash::make() but does not define a canonical mechanism for expiration validation. Two documented approaches exist for integrating expiration checks: embedding the logic within a custom Authenticate subclass that overrides the authenticate method, or hooking into the beforeLogin event of the Auth component. Neither approach is prescribed by the framework, and existing codebases exhibit inconsistent patterns. Additionally, least-privilege authorization - whether implemented through the legacy ACL component or the CakePHP 4 Authorization component - may influence the scope and timing of expiration checks, particularly regarding remember me sessions and interactive versus programmatic authentication.

Which approach best preserves separation of concerns while ensuring expiration checks apply only to interactive authentication events? How does the choice between legacy ACL and the newer Authorization component affect the feasibility of each location? What criteria should guide the selection of an expiration enforcement point in a production CakePHP deployment?