Starting with 4.0, disavowing a login is no longer just an event you have to handle. The bundle revokes the user's known contexts on the spot, and can end every session and force a password reset — with your own reactions running alongside.

A warning that only warns is half a security control ​

Picture the alert landing at 2am. Unknown device, unknown city. The user taps “It wasn't me”, and then?

The attacker's session is still open. Their IP address is now a known context — recorded, trusted, silent. Their next sign-in raises no alert at all. The user did everything right and nothing happened.

4.0 closes that window.

Three reactions, one line of config each ​

spiriit_auth_log:
    confirmation:
        enabled: true
        on_disavowal:
            revoke_known_contexts: true    # default
            invalidate_sessions: false     # opt-in
            force_password_reset: false    # opt-in

Revocation is on by default because it repairs the flaw that makes a disavowal dangerous in the first place. The other two are opt-in: they touch your session storage and your recovery flow, and no bundle can guess those.

Each reaction delegates its sensitive half to a small interface — a port — that your application implements. Write the class, and autoconfiguration wires it.

Enable a reaction whose port has no implementation and container compilation fails, naming the interface to write. A security measure that silently does nothing is worse than a build error.

Bring your own reaction ​

Notify your SOC, revoke API tokens, quarantine the account, page someone. One class:

final class NotifySecurityTeam implements DisavowalReactionInterface
{
    public function react(DisavowedLogin $disavowedLogin): void
    {
        // $disavowedLogin->user, ->userIdentity, ->authenticationLog
    }
}

It runs with the built-ins, before LOGIN_DISAVOWED is dispatched.

Your logs now remember who they were written for ​

A log is a journal: it must remember, not ask again. AbstractAuthenticationLog records the user identifier it was written with, next to the user class.

Two things follow. Checking whether a context is known no longer reloads the User entity — one query less on every single login. And a log keeps telling the truth about who signed in, even after the account row changes underneath it.

This one needs a schema migration and a back-fill. The upgrade guide covers both, including logs pointing at deleted users.

Get started ​

composer require spiriitlabs/auth-log-bundle:^4.0

PHP 8.2+, Symfony 6.4, 7.4 and 8.0, Doctrine ORM 3 or 4.

New here? Start with disavowal reactions. Already running the bundle? The upgrade guide is a ten-minute read and tells you exactly what your repository owes the new version.

Do you know who logged into your application last week? From where? On which device?

And more importantly: what happens when the user says “That wasn't me”?

That's often where it ends.

The numbers say the rest. The median intruder goes 14 days before anyone notices, and barely half of intrusions — 52 % — are caught by the organization itself, Mandiant reports. Everyone else finds out from a third party, or from a ransom note.

The password may have been stolen somewhere else. It usually was: credential abuse still turns up somewhere in 39 % of breaches, and half of ransomware victims had credentials leaked in the 95 days before the attack — Verizon's 2026 DBIR.

What your application can control is what happens next.

New IP address, new device, new location: notify the user.

“That was me” / “That wasn't me”

And if it wasn't them, take action: close sessions, revoke access, require a password change, raise an alert.

Speed is the whole game. Stolen access now changes hands 22 seconds after the initial compromise — it was more than eight hours in 2022. And breaches that run past 200 days cost about a third more than the ones closed sooner.

That's exactly what Auth Log Bundle is for: logging authentication attempts, detecting unusual contexts, and reacting when a login is disputed.

composer require spiriitlabs/auth-log-bundle

The question isn't whether an account will ever be compromised.

It's what you'll do when it happens.

Sources: Mandiant M-Trends 2026 · Verizon DBIR 2026 · IBM Cost of a Data Breach 2026