CakePHP Auth Component Not logging in when using $this->Auth->login();

Question

I'm new to cakePHP and I have read their documentation and I'm following their simple authentication example. I've also searched far and wide (including answers on this site) for an answer to my problem.

I'm using cakePHP 2.0 and my UsersController's login function looks like this:

function login() {
    if ($this->request->is('post')) {
        if ($this->Auth->login(/*$this->request->data*/)) {
            $this->redirect($this->Auth->redirect());
        }else {
            $this->Session->setFlash(__('Invalid username or password, try again'));
        }
    }
}

My AppController looks like this:

public $components = array(
                    'Session',
                    'Auth' => array(
                            'loginRedirect' => array('controller' => 'pages', 'action' => 'display'),
                            'logoutRedirect' => array('controller' => 'pages', 'action' => 'display')
                    )
        );

public function beforeFilter() {
    $this->Auth->loginAction = array('controller' => 'users', 'action' => 'login');
}

My User Model:

class User extends AppModel {

public $name = "User";

}

And the login form:

echo $this->Session->flash('auth');
echo $this->Form->create('User', array('action' => 'login'));
echo $this->Form->input('username');
echo $this->Form->input('password');
echo $this->Form->end('Login');

The problem is it doesn't log a user in. When $this->Auth->login() is called without $this->request->data as a parameter nothing is written in the session and the page just refreshes.However when you supply the $this->request->data it works, credentials are written to the session and I'm redirected correctly. However I've noticed that you can 'log in' anyone with $this->Auth->login($this->request->data) even if they are not present in the database. In addition to this, if I enter wrong credentials nothing happens, no flash messages are displayed.

I'm not trying to do anything special, all I want is the ability to log a user in. I have a simple users table with username and password fields and I have followed their example and read their documentation, but still nothing I have tried has worked.

I apologise if I have not supplied all the information needed to provide a response. Any help is greatly appreciated.

careful: you must leave login() empty at all costs. If you pass $this->request->data into it it will log this user in regardless of what the username and password is. this will compromise your login. try to debug what the hashed password is on lookup and compare it to the current hash string in the database. most likely they don't match! — mark

Ivan Ivan · Accepted Answer · 2012-08-02T15:00:27

I had the exact same experience. What happened to me was, at one point, I was able to log in successfully using some username and password, but I never had any code in the view that showed me I was logged in. I was also really confused that when I subsequently logged in with random usernames and passwords, it still gave me a successful login notification.

I think what happened was, if you are in a logged-in state, then $this->Auth->login() will return true no matter what username and password you enter. The solution would probably be to somehow call $this->Auth->logout() in your program, or empty your cookies so that the program doesn't specify you as being logged in anymore. Then $this->Auth->login() will work as normal again.

CakePHP Auth Component Not logging in when using $this->Auth->login();

2 Answers