diff --git a/cookbook/security/custom_password_authenticator.rst b/cookbook/security/custom_password_authenticator.rst
index 9ed7bbf98b3..644848da48a 100644
--- a/cookbook/security/custom_password_authenticator.rst
+++ b/cookbook/security/custom_password_authenticator.rst
@@ -65,6 +65,9 @@ the user::
                     );
                 }
 
+                // CAUTION: implement __toString method for $user object
+                // or pass the username (like a nickname, email address, etc.) instead $user
+                // otherwise you get a redirect error
                 return new UsernamePasswordToken(
                     $user,
                     $user->getPassword(),