cakephp auth->login() always returns true

Question

I am trying to make a simple login application with cake 2.4. here is the code for User model.

App::uses('AuthComponent', 'Controller/Component');
class User extends AppModel
{
public $useTable = "user_master";
public $primaryKey = "user_id";
/*
public $validate = array(
    'username' => array(
        'required' => array(
            'rule' => array('notEmpty'),
            'message' => 'A username is required'
            )
            ),
    'password' => array(
        'required' => array(
            'rule' => array('notEmpty'),
            'message' => 'A password is required'
            )
            ));
*/

public function beforeSave($options = array())
{
   if (isset($this->data[$this->alias]['password'])) 
   {
        $this->data[$this->alias]['password'] = AuthComponent::password($this->data[$this->alias]['password']);
   }
   return true;
}

}

In my UsersController code is..

public function beforeFilter() {
    parent::beforeFilter();
    $this->Auth->authorize = 'controller';
}

public function isAuthorized() {
    return true; 
}
public function index() {
    $this->User->recursive = 0;
    $this->set('users', $this->paginate());
}

public function view($id = null) {
    $this->User->id = $id;
    if (!$this->User->exists()) {
        throw new NotFoundException(__('Invalid user'));
    }
    $this->set('user', $this->User->read(null, $id));
}

public function add() {
    if ($this->request->is('post')) {
        $this->User->create();
        if ($this->User->save($this->request->data)) {
            $this->Session->setFlash(__('The user has been saved'));
            return $this->redirect(array('action' => 'index'));
        }
        $this->Session->setFlash(__('The user could not be saved. Please, try again.'));
    }
}

public function edit($id = null) {
    $this->User->id = $id;
    if (!$this->User->exists()) {
        throw new NotFoundException(__('Invalid user'));
    }
    if ($this->request->is('post') || $this->request->is('put')) {
        if ($this->User->save($this->request->data)) {
            $this->Session->setFlash(__('The user has been saved'));
            return $this->redirect(array('action' => 'index'));
        }
        $this->Session->setFlash(__('The user could not be saved. Please, try again.'));
    } else {
        $this->request->data = $this->User->read(null, $id);
        unset($this->request->data['User']['password']);
    }
}

public function delete($id = null) {
    $this->request->onlyAllow('post');

    $this->User->id = $id;
    if (!$this->User->exists()) {
        throw new NotFoundException(__('Invalid user'));
    }
    if ($this->User->delete()) {
        $this->Session->setFlash(__('User deleted'));
        return $this->redirect(array('action' => 'index'));
    }
    $this->Session->setFlash(__('User was not deleted'));
    return $this->redirect(array('action' => 'index'));
}



public function login() {
if ($this->request->is('post')) {
    //pr(AuthComponent::password($this->request->data[$this->alias]['password'])); 
    //debug($this->Auth->login()); die();
    if ($this->Auth->login()) {
        $this->Session->setFlash(__('hi'));
        return $this->redirect($this->Auth->redirect());
    }
    $this->Session->setFlash(__('Invalid username or password, try again'));
}
}

public function logout() {
$this->Session->destroy();
return $this->redirect($this->Auth->logout());
}

AppController code

App::uses('Controller', 'Controller');
App::uses('AuthComponent', 'Component');
class AppController extends Controller {

public $components = array(
    'DebugKit.Toolbar',
    'Session',
    'Auth' => array(
        'loginRedirect' => array('controller' => 'products', 'action' => 'index'),
        'logoutRedirect' => array('controller' => 'users', 'action' => 'login'),
        'loginError' => 'Invalid account specified',
        'authorize' => array('Controller')
    )
);

public function beforeFilter() {
    $this->Auth->allow('index', 'view');
}

login.ctp

<div class="users form">
<?php echo $this->Session->flash('auth'); ?>
<?php echo $this->Form->create('User'); ?>
<fieldset>
    <legend><?php echo __('Please enter your username and password'); ?></legend>
    <?php echo $this->Form->input('username');
    echo $this->Form->input('password');
?>
</fieldset>
<?php echo $this->Form->end(__('Login')); ?>
</div>

Now the problem is whenever I try to login with wrong credentials then also it always redirects to the product controller's index page.when I uncommented the line in UsersController debug($this->Auth->login()); die();

then it always shows true for all username and password.so can anyone please help me find where I am doing wrong?

Thanks in advance..

Answer 1

    public $components = array(
                    'loginAction' => array('controller'=>'Dashboard', 'action'=>'login'),
                    'loginRedirect' => array('contoller'=>'Dashboard', 'action'=>'login'),
                    'logoutRedirect' => array('controller'=>'Dashboard', 'action'=>'logout'),
                    'authenticate' => array(
                        'Form' => array(
                            'userModel' => 'User',
                            'fields' => array(
                                'username' => 'email',
                                'password'=>'password')
                        )
                    )
                )

);

Answer 2

Assuming your create.ctp is correct your code looks close to mine. I would suggest using the blowfish encryption.

    if (isset($this->data['User']['password'])) {
        $hash = Security::hash($this->data['User']['password'], 'blowfish');            
        $this->data['User']['password'] = $hash;
    }

Also try setting your Auth settings in the beforeFilter in your appcontroller instead of the $components variable. If I remember right I could not get mine to work that way either.

    public function beforeFilter() {  
        $this->Auth->authorize = array('Controller');
        $this->Auth->authenticate = array(
            'Blowfish' => array( 
                'userModel' => 'User',
                'fields' => array('username' => 'username', 'password' => 'password')
            )
        ); 
}