You should not add the "login" action to allow list. Doing so would // cause problems with normal functioning of AuthComponent. $this->Auth->allow(['add', .