[TYPO3-50-general] Touchless Security

[Christoph Blömer]

Hi,
I'm currently implementing some kind of task management for a class at 
university. So I'm trying to figure out how the current examples work, 
like the Blog or TYPO3 itself.
So today I tried to understand where the username and password from the 
TYPO3 login is checked. So there should be a voter-class somewhere.

As far as I understand the login uses this class:

F3::FLOW3::Security::Authentication::Token::UsernamePassword

And in the FLOW3.yml it's defined that it redirects to typo3/login if the Login is not valid.

But currently I could not find a code where the password is checked against an existing user. Only admin/password works. So it's also not a kind of fake login.
So it should be defined somewhere in the TYPO3 package.

It seams very touchless ;-)

Can somebody point me to the file where the check is done or how that works?

Furthermore, how is it possible with flow3 to store data in the session and retrieve it?


Thanks
Christoph

P.S: Does anybody know when the SVN login is coming back?