PHPackages jeanmarcos/module-admin-bypass - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. jeanmarcos/module-admin-bypass ActiveMagento2-module[Authentication & Authorization](/categories/authentication) jeanmarcos/module-admin-bypass ============================== Magento 2 development module that bypasses admin authentication and auto-logs in a hardcoded developer user. For local development only — guarded against production mode. 1.1.0(2mo ago)001MITPHPPHP ~8.1.0||~8.2.0||~8.3.0 Since Apr 27Pushed 2mo agoCompare [ Source](https://github.com/jeanmarcos-dev/module-admin-bypass)[ Packagist](https://packagist.org/packages/jeanmarcos/module-admin-bypass)[ RSS](/packages/jeanmarcos-module-admin-bypass/feed)WikiDiscussions main Synced 3w ago READMEChangelogDependencies (6)Versions (3)Used By (1) > 📦 **`jeanmarcos/module-admin-bypass`** — published to [Packagist](https://packagist.org/packages/jeanmarcos/module-admin-bypass). > > 🏠 **Source repository** for issues, PRs and releases: **[jeanmarcos-dev/magento-local-development](https://github.com/jeanmarcos-dev/magento-local-development)**. The standalone [`jeanmarcos-dev/module-admin-bypass`](https://github.com/jeanmarcos-dev/module-admin-bypass) repo is a **read-only mirror** auto-generated by CI on every release — direct commits to it are overwritten. Development\_AdminBypass ======================== [](#development_adminbypass) [![Packagist](https://camo.githubusercontent.com/d5b201b6b4015667be0c1e6f841d128eda0536b2d9b6251ca0e7d5d9f19a62b7/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f6a65616e6d6172636f732f6d6f64756c652d61646d696e2d6279706173732e737667)](https://packagist.org/packages/jeanmarcos/module-admin-bypass) > ⚠️ **FOR LOCAL DEVELOPMENT ONLY — NEVER ENABLE IN PRODUCTION** Bypasses Magento 2 admin authentication and auto-logs in a hardcoded development user (`local` / `local123`) whenever the admin login page is visited. --- What it does ------------ [](#what-it-does) - **`BypassAdminAuthentication`** (plugin `around` on `Magento\User\Model\User::verifyIdentity`) — accepts **any password** for any existing admin user. - **`AdminAutologin`** (plugin `around` on `Magento\Backend\Controller\Adminhtml\Auth\Login::execute`) — when `/admin` is visited and nobody is logged in, creates the admin user `local` (password `local123`, email `john.smith@gmail.com`, role `Administrators`) if missing and authenticates as that user. Redirects to `*/dashboard`. --- Safety model ------------ [](#safety-model) This module is **guarded by Magento's application mode**: Mode`Allow in Production` flagBehavior`developer` / `default`any**active** — bypass and autologin work`production``No` (default)**inactive** — Magento behaves normally, no user is created`production``Yes`**active** — explicit override (use at your own risk)The guard is implemented in [`Development_Core`](https://packagist.org/packages/jeanmarcos/module-core-local-development) (`Development\Core\Model\ProductionGuard::isEnabled()`) and wired into every plugin via a `virtualType` in `etc/di.xml` that binds it to the config path `development/admin_bypass/allow_in_production`. In production + flag off, the plugins short-circuit with `$proceed(...)` and do **not** create the `local` user nor touch authentication. --- Configuration ------------- [](#configuration) Panel path: **Stores → Configuration → ⚠ Development Modules → Admin Bypass → General → Allow in Production** - Default: `No`. - Changing this flag requires `bin/magento cache:clean config` to take effect. --- Install ------- [](#install) ``` composer require --dev jeanmarcos/module-admin-bypass bin/magento module:enable Development_AdminBypass bin/magento setup:upgrade bin/magento setup:di:compile bin/magento cache:flush ``` Kill switch (strongly recommended before any deploy) ---------------------------------------------------- [](#kill-switch-strongly-recommended-before-any-deploy) ``` bin/magento module:disable Development_AdminBypass bin/magento setup:upgrade bin/magento cache:flush ``` The `disable` path is the last line of defense — it removes the module entirely regardless of the `allow_in_production` flag. For permanent removal: ``` composer remove jeanmarcos/module-admin-bypass ``` --- Security risks (read before using) ---------------------------------- [](#security-risks-read-before-using) - Anyone who can reach `/admin` gains full `Administrators` access when the bypass is active. No password needed. - The hardcoded `local/local123` admin user persists in the database once created, even after disabling the module. - Credentials are in plain text in `Plugin/AdminAutologin.php` and are searchable in git history. After disabling the module in a shared environment, consider deleting the `local` admin user manually: ``` DELETE FROM admin_user WHERE username = 'local'; ``` --- File structure -------------- [](#file-structure) ``` AdminBypass/ ├── Plugin/ │ ├── AdminAutologin.php # autologin around plugin │ └── BypassAdminAuthentication.php # password bypass around plugin ├── etc/ │ ├── acl.xml # ACL for the config section │ ├── adminhtml/ │ │ └── system.xml # admin panel toggle │ ├── config.xml # default values │ ├── di.xml # plugin wiring + ProductionGuard virtualType │ └── module.xml # module declaration (depends on Development_Core) ├── composer.json ├── registration.php └── README.md ``` The production-guard helper lives in the shared core package [`jeanmarcos/module-core-local-development`](https://packagist.org/packages/jeanmarcos/module-core-local-development). --- Troubleshooting --------------- [](#troubleshooting) - **Toggle doesn't take effect:** `bin/magento cache:clean config`. - **Bypass still works after `module:disable`:** check `app/etc/config.php` for the module entry; run `setup:upgrade`. - **Autologin loops:** another plugin on `Login::execute` may be conflicting; inspect `generated/code/Magento/Backend/Controller/Adminhtml/Auth/Login/Interceptor.php`. --- Compatibility ------------- [](#compatibility) - Magento 2.4.x - PHP 8.1+ (uses constructor property promotion and `readonly` properties) - Depends on `jeanmarcos/module-core-local-development` (installed automatically by Composer). --- License ------- [](#license) MIT ### Health Score 37 — LowBetter than 81% of packages Maintenance83 Actively maintained with recent releases Popularity0 Limited adoption so far Community8 Small or concentrated contributor base Maturity50 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~0 days Total 2 Last Release 88d ago ### Community Maintainers ![](https://avatars.githubusercontent.com/u/26399111?v=4)[Jeanmarcos](/maintainers/jeanmarcos-dev)[@jeanmarcos-dev](https://github.com/jeanmarcos-dev) --- Top Contributors [![jeanmarcos-dev](https://avatars.githubusercontent.com/u/26399111?v=4)](https://github.com/jeanmarcos-dev "jeanmarcos-dev (2 commits)") --- Tags authmagentodevelopmentadminautologinmagento2magento 2dev-toolsbypass ### Embed Badge ![Health badge](/badges/jeanmarcos-module-admin-bypass/health.svg) ``` [![Health](https://phpackages.com/badges/jeanmarcos-module-admin-bypass/health.svg)](https://phpackages.com/packages/jeanmarcos-module-admin-bypass) ``` ### Alternatives [mollie/magento2 Mollie Payment Module for Magento 2 1131.9M16](/packages/mollie-magento2)[run-as-root/magento2-prometheus-exporter Magento2 Prometheus Exporter 68357.9k](/packages/run-as-root-magento2-prometheus-exporter)[mage-os/module-admin-activity-log The Admin Activity extension makes it easy to track all admin activity with comprehensive audit logging. 296.3k1](/packages/mage-os-module-admin-activity-log)[loki/magento2-components Core module for defining Alpine.js components with advanced AJAX features 1011.8k26](/packages/loki-magento2-components)[opengento/module-category-import-export This module add the capability to import and export the categories from the back-office. 1310.9k2](/packages/opengento-module-category-import-export)[angeo/module-llms-txt Magento 2 module for AI Engine Optimization (AEO). Generates spec-compliant llms.txt and llms-full.txt per llmstxt.org standard, plus streaming JSONL for vector indexing. Multi-store, multi-website, CLI, cron, async admin UI, Page Builder-aware sanitization, customer-group pricing, atomic writes, ETag/Cache-Control, .md mirrors. 111.1k](/packages/angeo-module-llms-txt) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)