It would be nice if the TwoFactorMiddleware would allow string only verify urls as well like this:

    'OneTimePasswordAuthenticator' => [
        'login' => true,
        'verifyAction' => '/verify',
    ],

Currently, it requires an array syntax for URLs which only works if the Router is preloaded with the routes via the RoutingMiddleware.

But I need this so that I can move the RoutingMiddleware AFTER both Auth middlewares and show nice error messages as a logged in user if someone tries to access an unknown URL (but still show them their personalized e.g. menu or header icons)

• CakePHP 5.1 RC1
• CakeDC/Users 14.2.1
• CakeDC/Auth 10.0.0