Critical PHP 8.5 Deprecation Halts Magento 2 AJAX Login: A Deep Dive into the Captcha Module Fix

As e-commerce platforms evolve, staying current with underlying technologies like PHP is crucial for performance, security, and stability. However, these upgrades can sometimes introduce unexpected challenges. A recent GitHub issue (magento/magento2#40875) highlights a critical deprecation in PHP 8.5 that significantly impacts Magento 2's AJAX customer login functionality, leading to frustrating 'Could not authenticate' errors for users.

The Problem: PHP 8.5 Deprecation Breaks Magento 2 AJAX Login

The core of the issue lies in a PHP 8.5 deprecation regarding the array_key_exists() function. Specifically, passing null as the key parameter to this function is now deprecated, with PHP recommending an empty string instead. While a deprecation might seem minor, Magento's robust error handling converts this into a critical exception, effectively breaking the login flow.

Merchants running Magento 2 on PHP 8.5 (or planning to upgrade) might encounter a scenario where customers attempting to sign in via an AJAX login popup (e.g., during checkout) receive the generic error message: "Could not authenticate. Please try again later". Simultaneously, the system logs a report.CRITICAL exception detailing the deprecation:

[2026-06-11T19:13:56.998006+00:00] report.CRITICAL: Exception: Deprecated Functionality: Using null as the key parameter for array_key_exists() is deprecated, use an empty s
tring instead in /var/www/vendor/magento/module-captcha/Helper/Data.php on line 92 in /var/www/vendor/magento/framework/App/ErrorHandler.php:61

The stack trace clearly points to Magento\Captcha\Helper\Data.php and Magento\Captcha\Model\Customer\Plugin\AjaxLogin.php as the culprits.

Root Cause: Missing Captcha Form ID

The detailed analysis reveals that when an AJAX login request payload lacks the captcha_form_id, the Magento\Captcha\Model\Customer\Plugin\AjaxLogin::aroundExecute() method resolves the form ID to null. This null value is then passed to Magento\Captcha\Helper\Data::getCaptcha(), which subsequently calls array_key_exists($formId, $this->_captcha). It's this specific call with a null key that triggers the PHP 8.5 deprecation and, consequently, Magento's critical exception, halting the login process.

The Solution: A Two-Pronged Fix for Compatibility

The proposed fix, detailed in the associated pull request, addresses the issue at two crucial points, ensuring both robustness and backward compatibility:

1. Normalize Form ID in Magento\Captcha\Helper\Data::getCaptcha(): The first part of the fix involves modifying the getCaptcha() method to normalize a null form ID to an empty string ('') before the array_key_exists() call. This is an elegant solution because PHP has historically coerced null array keys to '' on write, meaning this change is a no-op behavior-wise but crucial for PHP 8.5 compatibility. It prevents the deprecation from being triggered without altering existing functionality.
2. Default Missing captcha_form_id in Magento\Captcha\Model\Customer\Plugin\AjaxLogin::aroundExecute(): The second part ensures that the AjaxLogin plugin no longer feeds null downstream. By defaulting a missing captcha_form_id to '' instead of null, the issue is prevented at its source. The in_array() semantics remain unaffected, as null == '' under PHP's loose comparison.

These combined changes ensure that customer AJAX logins proceed successfully, and no deprecation warnings are logged, restoring a seamless user experience.

Manual Testing Scenarios

The issue description provides clear, actionable steps for manual testing, which is invaluable for developers and QA teams:

1. Run Magento on PHP 8.5.
2. Disable guest checkout (Stores > Configuration > Sales > Checkout > Checkout Options > Allow Guest Checkout: No).
3. Ensure CAPTCHA for the user_login form is not forced.
4. As a not-logged-in customer, add a product to the cart and proceed to checkout to trigger the login popup.
5. Attempt to sign in with existing customer credentials.

Before the fix, the login fails with the critical error. After the fix, the customer signs in successfully without any deprecation logs.

Shopping Mover's Perspective: The Importance of PHP Compatibility in Magento Migrations

This issue underscores a recurring theme in the Magento ecosystem: the critical importance of PHP version compatibility. For merchants considering or undergoing a Magento 1 to Magento 2 migration, or even upgrading their existing Adobe Commerce or Open Source instances, PHP version upgrades are a significant factor. Deprecations and changes in newer PHP versions can introduce subtle yet critical bugs that impact core functionalities like customer login, checkout, and order processing.

At Shopping Mover, we emphasize thorough testing and proactive planning for PHP compatibility during any migration or upgrade project. Issues like this highlight why a deep understanding of Magento's core, its dependencies, and the underlying server environment is non-negotiable. Our expertise helps businesses navigate these complexities, ensuring a smooth transition and a stable, high-performing e-commerce platform.

Staying informed about such community insights and actively participating in the Magento development landscape is key to maintaining a robust and future-proof online store. This fix is a testament to the community's efforts in keeping Magento aligned with modern PHP standards.