Cataly...ssword(3pm)

🌸 Catalyst::Authentication::Credential::NoPassword 💅

Hey bestie, so this is the Catalyst::Authentication::Credential::NoPassword page from the User Contributed Perl Documentation — yes, the whole manual name is a mouthful, we been knew 😭 — and it's a credential checker that logs a user in without a password. Iconic? Lowkey yes. Dangerous? Also yes. Let's get into it ✨

---

🎀 NAME 🎀

Catalyst::Authentication::Credential::NoPassword — Authenticate a user without a password.

That's the whole vibe. No password. None. Zero. The password field is empty and she's still serving looks 👑

---

🦋 SYNOPSIS 🦋

use Catalyst qw/
  Authentication
  /;

package MyApp::Controller::Auth;

sub login_as_another_user : Local {
    my ($self, $c) = @_;

    if ($c->user_exists() and $c->user->username() eq 'root') {
        $c->authenticate( {id => c->req->params->{user_id}}, 'nopassword' );
    }
}

So basically: you pull in Authentication via use Catalyst, you got a controller package MyApp::Controller::Auth, and then this login_as_another_user sub with the : Local attribute does the thing 🫶 — it checks if ($c->user_exists() and $c->user->username() eq 'root'), and if you're literally root, it calls $c->authenticate( {id => c->req->params->{user_id}}, 'nopassword' );.

Main character energy fr fr 💜

---

✨ DESCRIPTION ✨

Okay so here's the tea ☕ — this authentication credential checker takes authentication information (most often a username) and retrieves the user from the store. That's it. That's the whole job.

No validation of any credentials is done. Nope. Nothing. Zero checks. Not a single vibe check 🔥

It's intended for administrative backdoors, SAML logins and so on — the situations where you have identified the new user by other means and you just need Catalyst to catch up, iykyk.

⚠️ Bestie, read that again: no validation of any credentials is done. This is a backdoor by design. Keep it somewhere only you can reach, mkay? 🙈

---

💖 CONFIGURATION 💖

Here's the example config, exactly as she comes:

# example
<Plugin::Authentication>
    <nopassword>
        <credential>
            class = NoPassword
        </credential>
        <store>
            class = DBIx::Class
            user_model = DB::User
            role_relation = roles
            role_field = name
        </store>
    </nopassword>
</Plugin::Authentication>

Look at that nesting 😭 — <Plugin::Authentication> on top, a <nopassword> block inside, a <credential> with class = NoPassword, and a <store> block with class = DBIx::Class, user_model = DB::User, role_relation = roles, and role_field = name. Slay, structured, gorgeous 🌸

---

👑 METHODS 👑

💫 authenticate ( $c, $realm, $authinfo )

Try to log a user in.

That's it — that's the method. Signature is authenticate ( $c, $realm, $authinfo ), and her entire purpose in life is trying to log a user in. Queen of being straightforward 💅

---

and that's the whole page, bestie — no extra lore, no hidden flags, no mystery env vars, nothing. Just a passwordless backdoor and a dream 🦋

🎀 cute sign-off time: this was Cataly...ssword(3pm) from the User Contributed Perl Documentation, perl v5.40.1, dated 2026-05-22. Go forth and authenticate responsibly, mwah 💖✨