Question

I used the cookbook to create my own custom Authentication using the following code:

// Controller/Auth/CustomAuthenticate.php



App::uses('BaseAuthenticate', 'Controller/Component/Auth');

class CustomAuthenticate extends BaseAuthenticate {

    public function authenticate(CakeRequest $request, CakeResponse $response) {
        return false;
    }
} 

// Controller/UserController.php


class UserController extends AppController {
   var $components = array('Auth' => array('authenticate' => array('Custom')));

   public function login() {
      // some code that includes:
      $this->Auth->login($this->request->data);
   }
}

Somehow with correct credentials, the login seems to work, although the authenticate method in my CustomAuthentication class returns false.

I’m using CakePHP 2.1

Answer 1

you cannot expect this to work propery because you are not supposed to pass $this->request->data on login forms.

it is just

$this->Auth->login();

otherwise you are skipping authenticate and the passed data will ALWAYS log this user in. regardless if it is garbige or the correct credentials. never ever do that with login forms.