Limits of automatic session invalidation for expired credentials in CodeIgniter 4 Shield

Confirmed behavior

CodeIgniter 4 Shield’s Authenticator::attempt method checks the user’s isPasswordExpired flag and rejects the login attempt, but it does **not** destroy any existing authenticated session. Consequently, a session created before the password was marked expired remains valid until it expires naturally or is manually destroyed.

Likely explanation

Shield does not emit an event when a password expires, and there is no built‑in configuration flag to trigger session invalidation. The expiration check is performed only during authentication, so existing sessions are untouched.

Steps to implement session invalidation (middleware approach)

1. Create a middleware that runs after authentication (e.g., app/Http/Middleware/CheckPasswordExpiry.php).
2. In the middleware, load the current user via Shield’s authenticator and test isPasswordExpired. If true, destroy the session and redirect to a password‑reset route.
3. Register the middleware globally or on the routes that require protection.

<?php
namespace App\Http\Middleware;

use CodeIgniter\Shield\Authentication\Authenticator;
use CodeIgniter\HTTP\RequestInterface;
use CodeIgniter\HTTP\ResponseInterface;
use CodeIgniter\HTTP\URI;

class CheckPasswordExpiry
{
    protected $authenticator;

    public function __construct(Authenticator $authenticator)
    {
        $this->authenticator = $authenticator;
    }

    public function process(RequestInterface $request, $next): ResponseInterface
    {
        $user = $this->authenticator->currentUser();
        if ($user && $user->isPasswordExpired()) {
            // Destroy the session and force a password reset
            session()->destroy();
            return redirect()->to('/auth/reset-password')->with('warning', 'Your password has expired. Please set a new one.');
        }
        return $next($request);
    }
}

Alternative: event listener (if Shield version provides it)

If your Shield version includes an auth.passwordExpired event, you can listen for it and call session()->destroy() or auth()->logout() inside the listener. Check the Shield Events\AuthEvents class for availability.

Security trade‑offs

• Benefit: Immediate revocation of privileged access reduces the window where stale credentials can be abused, aligning with least‑privilege principles.
• Cost: Aggressive expiration policies may log users out mid‑task, causing frustration and increased support tickets. A graceful redirect to a reset flow mitigates disruption.

Missing diagnostic detail

To confirm whether you can use the event‑listener approach, please specify the exact version of CodeIgniter 4 Shield you are using (e.g., 4.0.0, 4.1.2, etc.).