CakePHP 3.6 authentication doesn't work

Question

I'm following the CakePHP tutorial:
https://book.cakephp.org/3.0/en/tutorials-and-examples/bookmarks/part-two.html

My CakePHP version is: 3.6.0
My Php version is: 7.2

Here is my src\Controller\AppController.php

<?php
namespace App\Controller;

use Cake\Controller\Controller;
use Cake\Event\Event;
class AppController extends Controller
{

    public function initialize()
    {
        parent::initialize();

        $this->loadComponent('RequestHandler');
        $this->loadComponent('Flash');
        $this->loadComponent('Auth', [
            'authenticate' => [
                'Form' => [
                    'fields' => [
                        'username' => 'email',
                        'password' => 'password'
                    ]
                ]
            ],
            'loginAction' => [
                'controller' => 'Users',
                'action' => 'login'
            ],
            'unauthorizedRedirect' => $this->referer() 
        ]);

        $this->Auth->allow(['display']);

    }
}

In my src\Controller\UsersController.php I added the following method:

public function login()
{
    if ($this->request->is('post')) {
        $user = $this->Auth->identify();
        if ($user) {
            $this->Auth->setUser($user);
            return $this->redirect($this->Auth->redirectUrl());
        }
        $this->Flash->error('Your username or password is incorrect.');
    }
}

I created the src\Template\Users\login.ctp file:

<h1>Login</h1>
<?= $this->Form->create() ?>
<?= $this->Form->control('email') ?>
<?= $this->Form->control('password') ?>
<?= $this->Form->button('Login') ?>
<?= $this->Form->end() ?>

My browser is informing the error: ERR_TOO_MANY_REDIRECTS

If I try to go to the following url: localhost:8765/bookmarks

Browser redirects to: http://localhost:8765/users/login?redirect=%2Fusers%2Flogin%3Fredirect%3D%252Fusers%252Flogin%253Fredirect%253D%25252Fusers%25252Flogin%25253Fredirect%25253D%2525252Fusers%2525252Flogin%2525253Fredirect%2525253D%252525252Fusers%252525252Flogin%252525253Fredirect%252525253D%25252525252Fusers%25252525252Flogin%25252525253Fredirect%25252525253D%2525252525252Fusers%2525252525252Flogin%2525252525253Fredirect%2525252525253D%252525252525252Fusers%252525252525252Flogin%252525252525253Fredirect%252525252525253D%25252525252525252Fusers%25252525252525252Flogin%25252525252525253Fredirect%25252525252525253D%2525252525252525252Fusers%2525252525252525252Flogin%2525252525252525253Fredirect%2525252525252525253D%252525252525252525252Fusers%252525252525252525252Flogin%252525252525252525253Fredirect%252525252525252525253D%25252525252525252525252Fusers%25252525252525252525252Flogin%25252525252525252525253Fredirect%25252525252525252525253D%2525252525252525252525252Fusers%2525252525252525252525252Flogin%2525252525252525252525253Fredirect%2525252525252525252525253D%252525252525252525252525252Fusers%252525252525252525252525252Flogin%252525252525252525252525253Fredirect%252525252525252525252525253D%25252525252525252525252525252Fusers%25252525252525252525252525252Flogin%25252525252525252525252525253Fredirect%25252525252525252525252525253D%2525252525252525252525252525252Fusers%2525252525252525252525252525252Flogin%2525252525252525252525252525253Fredirect%2525252525252525252525252525253D%252525252525252525252525252525252Fusers%252525252525252525252525252525252Flogin%252525252525252525252525252525253Fredirect%252525252525252525252525252525253D%25252525252525252525252525252525252Fusers%25252525252525252525252525252525252Flogin%25252525252525252525252525252525253Fredirect%25252525252525252525252525252525253D%2525252525252525252525252525252525252Fusers%2525252525252525252525252525252525252Flogin%2525252525252525252525252525252525253Fredirect%2525252525252525252525252525252525253D%252525252525252525252525252525252525252Fbookmarks

Answer 1

You should add login action to allowed list:

$this->Auth->allow([
    'display',
    'login',
]);

or read this comment: https://stackoverflow.com/a/49928585/182823