cakephp - Login Script in 2.4.2 is not working

Question

I am new to cakephp. I have a problom while login. With wrong name and password redirects to login home page.

UsersController.php

public function login() {
    $this->layout = 'admin-login';
    if ($this->request->is('post')) {
        if ($this->Auth->login($this->request->data)) {
            return $this->redirect($this->Auth->redirectUrl())
        } else {
            $this->Session->setFlash(__('Username or password is incorrect'), 'default', array(), 'auth');
        }
    }
}

AppController.php

 public $components = array(
    'Session',
    'Auth' => array(
        'loginRedirect' => array('controller' => 'users', 'action' => 'index'),
        'logoutRedirect' => array('controller' => 'users', 'action' => 'login'),
        'loginAction' => array('controller' => 'users', 'action' => 'login')
    )
);

 public function beforeFilter() {
    $this->Auth->allow("login");
    //$this->Auth->authorize = array('Controller');
    $this->Auth->authenticate = array(
        'Form' => array (
            'scope'  => array(
                'User.is_active' => 1
            ) 
        )
    );   
}
public function isAuthorized($user) {
    return true;
}

login.ctp

echo $this->Form->create('User');
echo $this->Form->input('username');
echo $this->Form->input('password'); 
echo $this->Form->submit(__('Submit');
echo $this->Form->end();

When i fill the wrong username & password & click on submit button it redirect to home page, Thanks.

Answer 1

You are using AuthComponent::login() wrong, you are only supposed to pass data to it in case you want to manually login a user, ie without automatic authentication.

If you want to use the components authentication functionality just call $this->Auth->login()

See also: http://book.cakephp.org/2.0/en/core-libraries/components/authentication.html#identifying-users-and-logging-them-in

In 2.x $this->Auth->login($this->request->data) will log the user in with whatever data is posted, whereas in 1.3 $this->Auth->login($this->data) would try to identify the user first and only log in when successful.