Magento 2 & PHP 8.5: Decoding and Fixing the AJAX Login 'Could Not Authenticate' Error

As e-commerce platforms evolve, staying current with underlying technologies like PHP is crucial for performance, security, and stability. However, these upgrades can sometimes introduce unexpected challenges. A recent GitHub issue (magento/magento2#40875) highlights a critical deprecation in PHP 8.5 that significantly impacts Magento 2's AJAX customer login functionality, leading to frustrating 'Could not authenticate' errors for users. At Shopping Mover, we understand that such issues can disrupt your business and customer trust, especially during or after a platform migration or upgrade.

The Problem: PHP 8.5 Deprecation Breaks Magento 2 AJAX Login

The core of the issue lies in a PHP 8.5 deprecation regarding the array_key_exists() function. Specifically, passing null as the key parameter to this function is now deprecated, with PHP recommending an empty string instead. While a deprecation might seem minor, Magento's robust error handling converts this into a critical exception, effectively breaking the login flow.

Merchants running Magento 2 on PHP 8.5 (or planning to upgrade) might encounter a scenario where customers attempting to sign in via an AJAX login popup (e.g., during checkout) receive the generic error message: "Could not authenticate. Please try again later". Simultaneously, the system logs a report.CRITICAL exception detailing the deprecation:

[2026-06-11T19:13:56.998006+00:00] report.CRITICAL: Exception: Deprecated Functionality: Using null as the key parameter for array_key_exists() is deprecated, use an empty s
tring instead in /var/www/vendor/magento/module-captcha/Helper/Data.php on line 92 in /var/www/vendor/magento/framework/App/ErrorHandler.php:61

The stack trace clearly points to Magento\Captcha\Helper\Data.php and Magento\Captcha\Model\Customer\Plugin\AjaxLogin.php as the culprits. This isn't just a minor log entry; it's a full-blown exception that halts the login process, directly impacting your conversion rates and customer satisfaction.

Root Cause: Missing Captcha Form ID

The detailed analysis reveals that when an AJAX login request payload lacks the captcha_form_id, the Magento\Captcha\Model\Customer\Plugin\AjaxLogin::aroundExecute() method resolves the form ID to null. This null value is then passed to Magento\Captcha\Helper\Data::getCaptcha(), which subsequently calls array_key_exists($formId, $this->_captcha). It is this specific call, with null as the key, that triggers the PHP 8.5 deprecation and, consequently, Magento's critical exception.

This scenario is particularly common when CAPTCHA is not explicitly configured or required for the user_login form, meaning the captcha_form_id might simply be absent from the request payload. The system, expecting a string, receives null, leading to the breakdown.

The Shopping Mover Perspective: Proactive Compatibility is Key

At Shopping Mover, we frequently assist merchants with complex Magento migrations and upgrades. Issues like this underscore the critical importance of thorough compatibility testing when moving to newer PHP versions or migrating your store. A seemingly small change in PHP's behavior can have cascading effects across a large, intricate platform like Magento 2 (both Open Source and Adobe Commerce).

Ignoring these deprecations can lead to:

• Revenue Loss: Broken login flows directly prevent purchases.
• Poor User Experience: Frustrated customers may abandon their carts or your site entirely.
• Security Risks: Outdated PHP versions can expose your store to vulnerabilities.
• Increased Maintenance Costs: Reactive fixes are often more expensive and time-consuming than proactive updates.

Our expertise in Magento development and integrations allows us to identify and mitigate such risks, ensuring a smooth transition and stable operation for your e-commerce business.

The Solution: A Two-Pronged Approach

The fix, as proposed and implemented, addresses the root cause in two key areas:

1. Normalization in Magento\Captcha\Helper\Data::getCaptcha(): The helper method is updated to normalize a null form ID to an empty string ('') before calling array_key_exists(). This is a behavior-neutral change, as PHP has historically coerced null array keys to empty strings on write. This ensures that any caller of this public helper method, not just the AJAX login plugin, benefits from the fix without introducing backward compatibility breaks.
2. Defaulting in Magento\Captcha\Model\Customer\Plugin\AjaxLogin::aroundExecute(): The plugin is modified to default a missing captcha_form_id to an empty string ('') instead of null. This prevents null from being passed downstream in the first place, making the plugin's interaction with the Captcha helper robust against the PHP 8.5 deprecation. The in_array() semantics remain unaffected, as null == '' under PHP's loose comparison.

This comprehensive fix ensures that the Magento 2 core is fully compatible with PHP 8.5's stricter handling of array_key_exists(), restoring the AJAX login functionality.

Manual Testing Scenarios

To verify the fix, you can follow these steps:

1. Run your Magento instance on PHP 8.5.
2. Navigate to Stores > Configuration > Sales > Checkout > Checkout Options and set Allow Guest Checkout to No, then flush the cache.
3. Ensure CAPTCHA for the user_login form is not forced (use default configuration).
4. As a not-logged-in customer, add a product to the cart and proceed to checkout. The "Checkout as a new customer / Checkout using your account" popup should appear.
5. In the "Checkout using your account" block, enter the credentials of an existing customer and click Sign In.
6. Before the fix: The request fails with "Could not authenticate. Please try again later", and var/report/var/log contains the critical deprecation exception.
7. After the fix: The customer signs in successfully, and no deprecation is logged.

Broader Implications and Best Practices for Magento Development

This incident serves as a powerful reminder for all Magento merchants and developers:

• Stay Updated: Regularly update your Magento instance to the latest stable versions to benefit from critical bug fixes and compatibility improvements.
• Test Thoroughly: Before any major PHP upgrade or Magento update, conduct comprehensive regression testing, especially on critical paths like checkout, login, and account management.
• Monitor Logs: Regularly review your Magento logs (var/log and var/report) for critical errors, warnings, and deprecations. These often provide early warnings of potential issues.
• Leverage Expert Partners: For complex upgrades, migrations, or custom development, partnering with Magento experts like Shopping Mover can save significant time, resources, and prevent costly downtime. We specialize in ensuring your Magento store runs flawlessly on the latest technologies.

Ensuring your Magento 2 store is robust and future-proof requires continuous attention to its underlying technology stack. Addressing issues like the PHP 8.5 AJAX login deprecation promptly is vital for maintaining a seamless customer experience and protecting your e-commerce revenue.

If you're facing similar challenges or planning a Magento migration or upgrade, don't hesitate to reach out to the experts at Shopping Mover. We're here to help you navigate the complexities of e-commerce development and integrations, ensuring your platform is always performing at its best.