Stop event propagation when returning response.

src/Controller/Component/AuthComponent.php

@@ -236,7 +236,7 @@ class AuthComponent extends Component {
  * of login form data.
  *
  * @param Event $event The startup event.
- * @return bool
+ * @return bool|\Cake\Network\Response
  */
 	public function startup(Event $event) {
 		$controller = $event->subject();
@@ -254,7 +254,11 @@ class AuthComponent extends Component {
 		}
 
 		if (!$this->_getUser()) {
-			return $this->_unauthenticated($controller);
+			$result = $this->_unauthenticated($controller);
+			if ($result instanceof Response) {
+				$event->stopPropagation();
+			}
+			return $result;
 		}
 
 		if ($this->_isLoginAction($controller) ||
@@ -264,7 +268,11 @@ class AuthComponent extends Component {
 			return true;
 		}
 
-		return $this->_unauthorized($controller);
+		$result = $this->_unauthorized($controller);
+		if ($result instanceof Response) {
+			$event->stopPropagation();
+		}
+		return $result;
 	}
 
 /**

tests/TestCase/Controller/Component/AuthComponentTest.php

@@ -219,6 +219,7 @@ class AuthComponentTest extends TestCase {
 
 		$this->Auth->Session->delete('Auth');
 		$result = $this->Controller->Auth->startup($event);
+		$this->assertTrue($event->isStopped());
 		$this->assertInstanceOf('Cake\Network\Response', $result);
 		$this->assertTrue($this->Auth->Session->check('Message.auth'));
 
@@ -398,7 +399,7 @@ class AuthComponentTest extends TestCase {
 		$this->Controller->request['action'] = 'camelCase';
 		$this->assertInstanceOf('Cake\Network\Response', $this->Controller->Auth->startup($event));
 
-		$this->Controller->Auth->allow('*');
+		$this->Controller->Auth->allow();
 		$this->Controller->Auth->deny();
 
 		$this->Controller->request['action'] = 'camelCase';
@@ -911,6 +912,7 @@ class AuthComponentTest extends TestCase {
 
 		$response = $this->Auth->startup($event);
 
+		$this->assertTrue($event->isStopped());
 		$this->assertEquals(403, $response->statusCode());
 		$this->assertEquals(
 			"Ajax!\nthis is the test element",