# “Invalid username or password” when logging in

**URL:** <https://discourse.cakephp.org/t/invalid-username-or-password-when-logging-in/7681>\
**Category:** Need Help\
**Created:** [April 19, 2020, 11:33pm UTC](https://discourse.cakephp.org/t/invalid-username-or-password-when-logging-in/7681 "2020-04-19T23:33:37Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![anon81960487](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@anon81960487](https://discourse.cakephp.org/u/anon81960487)\
**Post date:** [April 19, 2020, 11:33pm UTC](https://discourse.cakephp.org/t/invalid-username-or-password-when-logging-in/7681/1 "2020-04-19T23:33:37Z")

</div>

There are other threads with this issue, but none of the solutions there have fixed it for me. I am trying to get a user system setup with CakePHP.

When I go to /users/add and create an account, the password is hashed, but when I login, I get the error `Invalid username or password` regardless of if I enter the email and password, or even the email and hashed password. I can’t seem to find the issue, any help would be appreciated.

Here are the relevant files, let me know if you need anything else:

login.php - [https://pastebin.com/awUzAs52](https://pastebin.com/awUzAs52)

UserController.php - [https://pastebin.com/vJMs7JgT](https://pastebin.com/vJMs7JgT)

Application.php - [https://pastebin.com/Pg7UNQBd](https://pastebin.com/Pg7UNQBd)

AppController.php - [https://pastebin.com/gen2yraP](https://pastebin.com/gen2yraP)

UsersTable.php - [https://pastebin.com/dduCAfAj](https://pastebin.com/dduCAfAj)

User.php - [https://pastebin.com/Wd3XJPU9](https://pastebin.com/Wd3XJPU9)

Thanks in advance for any help you can provide.

---

<div class="post-metadata">

**Author:** ![dreamingmind](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/dreamingmind/32/1857_2.png) [@dreamingmind](https://discourse.cakephp.org/u/dreamingmind)\
**Post date:** [April 20, 2020, 2:12am UTC](https://discourse.cakephp.org/t/invalid-username-or-password-when-logging-in/7681/2 "2020-04-20T02:12:27Z")

</div>

Isn’t the Authentication config method in `Application.php` supposed to be:

`public function getAuthenticationService(ServerRequestInterface $request)`

since the Middleware calls that hook?

I see your Application.php opts for

‘protected function configAuth(): \Authentication\AuthenticationService’.

You are calling the config method as an argument when you load the middleware on the queue but I don’t think that will work. The middleware needs to get an instance of the the application so recursive calling of the middleware queue can proceed.

There is a second constructor argument for the middleware but I don’t think this a place to put your config method either. Naming the method properly and letting the middleware call it will be the way to go.

---

<div class="post-metadata">

**Author:** ![anon81960487](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@anon81960487](https://discourse.cakephp.org/u/anon81960487)\
**Post date:** [April 21, 2020, 4:46am UTC](https://discourse.cakephp.org/t/invalid-username-or-password-when-logging-in/7681/3 "2020-04-21T04:46:05Z")

</div>

I tried that and it threw an error, I followed the CMS tutorial for setting up users, and I have since copied as many of the files as I can from there, and I still can’t get it working. Do you have any other ideas on what it could be (or what files I should look into)?

---

<div class="post-metadata">

**Author:** ![dreamingmind](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/dreamingmind/32/1857_2.png) [@dreamingmind](https://discourse.cakephp.org/u/dreamingmind)\
**Post date:** [April 21, 2020, 4:48am UTC](https://discourse.cakephp.org/t/invalid-username-or-password-when-logging-in/7681/4 "2020-04-21T04:48:27Z")

</div>

what was the error and what did your modifications look like?

---

<div class="post-metadata">

**Author:** ![anon81960487](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@anon81960487](https://discourse.cakephp.org/u/anon81960487)\
**Post date:** [April 21, 2020, 4:52am UTC](https://discourse.cakephp.org/t/invalid-username-or-password-when-logging-in/7681/5 "2020-04-21T04:52:51Z")

</div>

I modified it the way you initially said to, and it did a whitescreen, I modified the AppController.php and Application.php files to be the same as the finished tutorial ([https://github.com/cakephp/cms-tutorial/](https://github.com/cakephp/cms-tutorial/)), but that doesn’t seem to be helping anything.

---

<div class="post-metadata">

**Author:** ![drtrppr](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/drtrppr/32/1763_2.png) [@drtrppr](https://discourse.cakephp.org/u/drtrppr)\
**Post date:** [April 21, 2020, 10:09am UTC](https://discourse.cakephp.org/t/invalid-username-or-password-when-logging-in/7681/6 "2020-04-21T10:09:45Z")

</div>

> [@anon81960487](#):
>
> Application.php - [https://pastebin.com/Pg7UNQBd](https://pastebin.com/Pg7UNQBd)

Is this the current application.php you’re using? If so, I do miss some of these?

use Authentication\AuthenticationService;  
use Authentication\AuthenticationServiceInterface;  
use Authentication\AuthenticationServiceProviderInterface;  
use Authentication\Middleware\AuthenticationMiddleware;

---

<div class="post-metadata">

**Author:** ![anon81960487](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@anon81960487](https://discourse.cakephp.org/u/anon81960487)\
**Post date:** [April 21, 2020, 3:49pm UTC](https://discourse.cakephp.org/t/invalid-username-or-password-when-logging-in/7681/7 "2020-04-21T15:49:51Z")

</div>

Added those in, it is still not working.

---

<div class="post-metadata">

**Author:** ![drtrppr](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/drtrppr/32/1763_2.png) [@drtrppr](https://discourse.cakephp.org/u/drtrppr)\
**Post date:** [April 21, 2020, 8:14pm UTC](https://discourse.cakephp.org/t/invalid-username-or-password-when-logging-in/7681/8 "2020-04-21T20:14:06Z")

</div>

use Cake\Auth\DefaultPasswordHasher;

vs.

use Authentication\PasswordHasher\DefaultPasswordHasher;

in User.php?

---

<div class="post-metadata">

**Author:** ![anon81960487](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@anon81960487](https://discourse.cakephp.org/u/anon81960487)\
**Post date:** [April 22, 2020, 9:31pm UTC](https://discourse.cakephp.org/t/invalid-username-or-password-when-logging-in/7681/9 "2020-04-22T21:31:03Z")

</div>

Tried that, it still isn’t working, even when I create a new user and try to login with that.

---

<div class="post-metadata">

**Author:** ![anon81960487](https://avatars.discourse-cdn.com/v4/letter/a/958977/32.png) [@anon81960487](https://discourse.cakephp.org/u/anon81960487)\
**Post date:** [April 22, 2020, 9:58pm UTC](https://discourse.cakephp.org/t/invalid-username-or-password-when-logging-in/7681/10 "2020-04-22T21:58:08Z")

</div>

Thanks to everyone’s help, I fixed it by re-baking the user controller and following the instructions on the CMS tutorial again. It is working now, thanks again for the help!