it SHOULD work, but it works with the locale querystring argument, instead of the url prefix.

I.e. Security/login?l=en_US

This is due to Security being a controller, and not a page.

If it's not doing that, then it should be fixed to do that. :D

Here's the code in question.

https://github.com/tractorcow-farm/silverstripe-fluent/blob/5.0/src/Extension/FluentSiteTreeExtension.php#L109-L116

I believe the issue is getRecordLocale()(Link) is failing to obtain the relevant local when on Security and is falling back to getCurrentLocale().

Sorry, you are right, it's probably that code in question failing on unsaved records. :)

Yep, it's the generation of the locale menu items that has the issue.

Default LocaleMenu.ss

            <ul>
                <% loop $Locales %>
                    <li class="$LinkingMode">
                        <a href="$Link.ATT" <% if $LinkingMode != 'invalid' %>rel="alternate"
                           hreflang="$HrefLang"<% end_if %>>$Title.XML</a>
                    </li>
                <% end_loop %>
            </ul>

Results in: From login screen. (once #688 is resolved)

<ul>
        <li class="current">
            <a href="/Security/login?l=de_AT" rel="alternate"
                hreflang="de-at">German</a>
        </li>
    
        <li class="link">
            <a href="/Security/login?l=de_AT" rel="alternate"
                hreflang="en-gb">English</a>
        </li>
</ul>

(Note that the "English" link has the incorrect "de_AT" query string argument, instead of "en_GB")

Possible fix at #691

The issue is that RecordLocale doesn't tell "unsaved" records what it's locale is. We can clone and mock the query param for that object to force it. :)