Why can I access a rodauth protected route with an unverified account?

[pboling]

I added this to my controller:

  before_action -> { rodauth.require_authentication }

I am logged in as a new account that hasn't been verified yet. Verification is working, but I haven't done it for this user. I am able to access the route protected by the above before action. Is this expected?

[janko]

Yes, if you're logged in, then you're able to access protected routes. You can either set create_account_autologin? to false to prevent login, or not enable the verify_account_grace_period feature.