title: Symfony: Why some user checks should be performed after authentication?
body: <p>I don't get this. <code>UserCheckerInterface</code> has two methods: <code>checkPreAuth</code> and <code>checkPostAuth</code>. Now let's look at their implementation in the class <code>UserChecker</code>:</p>
  
  <pre><code>class UserChecker implements UserCheckerInterface
  {
      /**
       * {@inheritdoc}
       */
      public function checkPreAuth(UserInterface $user)
      {
          if (!$user instanceof AdvancedUserInterface) {
              return;
          }
  
          if (!$user-&gt;isAccountNonLocked()) {
              $ex = new LockedException('User account is locked.');
              $ex-&gt;setUser($user);
              throw $ex;
          }
  
          if (!$user-&gt;isEnabled()) {
              $ex = new DisabledException('User account is disabled.');
              $ex-&gt;setUser($user);
              throw $ex;
          }
  
          if (!$user-&gt;isAccountNonExpired()) {
              $ex = new AccountExpiredException('User account has expired.');
              $ex-&gt;setUser($user);
              throw $ex;
          }
      }
  
      /**
       * {@inheritdoc}
       */
      public function checkPostAuth(UserInterface $user)
      {
          if (!$user instanceof AdvancedUserInterface) {
              return;
          }
  
          if (!$user-&gt;isCredentialsNonExpired()) {
              $ex = new CredentialsExpiredException('User credentials have expired.');
              $ex-&gt;setUser($user);
              throw $ex;
          }
      }
  }
  </code></pre>
  
  <p>Why should <code>isCredentialsNonExpired()</code> be done AFTER authentication? Shouldn't we just not allow the user with expired credentials to authenticate? And bonus question: Where should we really do this "post authentication" check? After setting the authentication token?</p>