silverstripe-framework/_config/security.yml

---
Name: coreauthentication
---
SilverStripe\Core\Injector\Injector:
  SilverStripe\Security\MemberAuthenticator\SessionAuthenticationHandler:
    properties:
      SessionVariable: loggedInAs
  SilverStripe\Security\MemberAuthenticator\CookieAuthenticationHandler:
    properties:
      TokenCookieName: alc_enc
      DeviceCookieName: alc_device
      CascadeInTo: '%$SilverStripe\Security\MemberAuthenticator\SessionAuthenticationHandler'
  SilverStripe\Security\AuthenticationHandler:
    class: SilverStripe\Security\RequestAuthenticationHandler
    properties:
      Handlers:
        session: '%$SilverStripe\Security\MemberAuthenticator\SessionAuthenticationHandler'
        alc: '%$SilverStripe\Security\MemberAuthenticator\CookieAuthenticationHandler'
---
Name: coresecurity
After:
  - '#requestprocessors'
---
SilverStripe\Core\Injector\Injector:
  SilverStripe\Control\Director:
    properties:
      Middlewares:
        AuthenticationMiddleware: '%$SilverStripe\Security\AuthenticationMiddleware'
        BasicAuthMiddleware: '%$SilverStripe\Security\BasicAuthMiddleware'
        PasswordExpirationMiddleware: '%$SilverStripe\Security\PasswordExpirationMiddleware'
  SilverStripe\Security\AuthenticationMiddleware:
    properties:
      AuthenticationHandler: '%$SilverStripe\Security\AuthenticationHandler'
  SilverStripe\Security\BasicAuthMiddleware:
    properties:
      URLPatterns: []
  SilverStripe\Security\Security:
    properties:
      Authenticators:
        default: '%$SilverStripe\Security\MemberAuthenticator\MemberAuthenticator'
  SilverStripe\Security\CMSSecurity:
    properties:
      Authenticators:
        cms: '%$SilverStripe\Security\MemberAuthenticator\CMSMemberAuthenticator'
  SilverStripe\Security\IdentityStore: '%$SilverStripe\Security\AuthenticationHandler'
  SilverStripe\Security\SudoMode\SudoModeServiceInterface:
    class: SilverStripe\Security\SudoMode\SudoModeService

SilverStripe\Security\PasswordExpirationMiddleware:
  default_redirect: Security/changepassword
  whitelisted_url_startswith:
    - Security/basicauthlogin/
    - Security/changepassword/
    - Security/login/
    - Security/logout/