Download the PHP package jeanmarcos/module-customer-bypass without Composer
On this page you can find all versions of the php package jeanmarcos/module-customer-bypass. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download jeanmarcos/module-customer-bypass
More information about jeanmarcos/module-customer-bypass
Files in jeanmarcos/module-customer-bypass
Package module-customer-bypass
Short Description Magento 2 development module that bypasses storefront customer authentication so any password is accepted for any existing customer. For local development only — guarded against production mode.
License MIT
Informations about the package module-customer-bypass
📦
jeanmarcos/module-customer-bypass— published to Packagist.🏠 Source repository for issues, PRs and releases: jeanmarcos-dev/magento-local-development. The standalone
jeanmarcos-dev/module-customer-bypassrepo is a read-only mirror auto-generated by CI on every release — direct commits to it are overwritten.
Development_CustomerBypass
⚠️ FOR LOCAL DEVELOPMENT ONLY — NEVER ENABLE IN PRODUCTION
Bypasses Magento 2 customer authentication. Any password is accepted for any existing customer account on storefront login.
What it does
BypassCustomerAuthentication(pluginaroundonMagento\Customer\Model\AccountManagement::authenticate) — resolves the customer viaCustomerRepositoryInterface::get($username)and returns it, ignoring the password.
No new users are created; only existing customers can be impersonated.
Safety model
Guarded by Magento's application mode:
| Mode | Allow in Production flag |
Behavior |
|---|---|---|
developer / default |
any | active — password ignored |
production |
No (default) |
inactive — normal authentication |
production |
Yes |
active — explicit override |
Implementation: Development_Core (Development\Core\Model\ProductionGuard::isEnabled()), wired via a virtualType in etc/di.xml bound to the config path development/customer_bypass/allow_in_production. When disabled, the plugin delegates to $proceed($username, $password) and Magento authenticates normally.
Configuration
Panel path: Stores → Configuration → ⚠ Development Modules → Customer Bypass → General → Allow in Production
- Default:
No. - Changing the flag requires
bin/magento cache:clean config.
Install
Kill switch
For permanent removal:
Security risks
- Anyone who knows a customer's email/username can log in as them without the password.
- Exposes full order history, addresses, saved payment methods (if stored), and wishlists.
- No audit trail: bypassed logins look identical to legitimate ones in the session.
File structure
The production-guard helper lives in the shared core package
jeanmarcos/module-core-local-development.
Troubleshooting
- Toggle doesn't take effect:
bin/magento cache:clean config. - "Invalid login or password" still appears: the plugin only overrides
AccountManagement::authenticate; some integrations (OAuth, external SSO) use different entry points and are unaffected.
Compatibility
- Magento 2.4.x
- PHP 8.1+
- Depends on
jeanmarcos/module-core-local-development(installed automatically by Composer).
License
MIT
All versions of module-customer-bypass with dependencies
magento/framework Version >=103.0
magento/module-customer Version *
magento/module-config Version *
jeanmarcos/module-core-local-development Version ^1.0