src/Web/User.php
protected function beforeLogin($identity, $cookieBased, $duration)
    {
        return $this->emitAndWait(static::EVENT_BEFORE_LOGIN, [&$identity, $cookieBased, $duration]);
    }
protected function beforeLogin($identity, $cookieBased, $duration)
    {
        return $this->emitAndWait(static::EVENT_BEFORE_LOGIN, [&$identity, $cookieBased, $duration]);
    }
This method is called before logging in a user.
The default implementation will trigger the [[EVENT_BEFORE_LOGIN]] event.
If you override this method, make sure you call the parent implementation
so that the event is triggered.
@param IdentityInterface $identity the user identity information
@param bool              $cookieBased whether the login is cookie-based
@param int               $duration number of seconds that the user can remain in logged-in status.
If 0, it means login till the user closes the browser or the session is manually destroyed.
@return \React\Promise\PromiseInterface