title: Yii2 REST API doesn't return expected results
body: <p>I'm trying to create a simple REST API with authentication. But, something is wrong.</p>
  
  <p>I'm using the advanced template with Yii Framework 2. I never had programed for yii before, so I'm learning.</p>
  
  <p>My code:</p>
  
  <p>~/api
      -->config
        --> main.php</p>
  
  <pre><code>&lt;?php
  
  $params = array_merge(
      require(__DIR__ . '/../../common/config/params.php'),
      require(__DIR__ . '/../../common/config/params-local.php'),
      require(__DIR__ . '/params.php'),
      require(__DIR__ . '/params-local.php')
  );
  
  return [
      'id' =&gt; 'app-api',
      'basePath' =&gt; dirname(__DIR__),    
      'bootstrap' =&gt; ['log'],
      'modules' =&gt; [
          'v1' =&gt; [
              'basePath' =&gt; '@app/modules/v1',
              'class' =&gt; 'api\modules\v1\Module'
          ]
      ],
      'components' =&gt; [        
          'user' =&gt; [
              'identityClass' =&gt; 'common\models\User',
              'enableAutoLogin' =&gt; false,
          ],
          'log' =&gt; [
              'traceLevel' =&gt; YII_DEBUG ? 3 : 0,
              'targets' =&gt; [
                  [
                      'class' =&gt; 'yii\log\FileTarget',
                      'levels' =&gt; ['error', 'warning'],
                  ],
              ],
          ],
          'request' =&gt; [
              'class' =&gt; '\yii\web\Request',
              'enableCookieValidation' =&gt; false,
              'parsers' =&gt; [
                  'application/json' =&gt; 'yii\web\JsonParser',
              ],
          ],        
          'urlManager' =&gt; [
              'enablePrettyUrl' =&gt; true,
              'enableStrictParsing' =&gt; true,
              'showScriptName' =&gt; false,
              'rules' =&gt; [
                  [
                      'class' =&gt; 'yii\rest\UrlRule', 
                      'controller' =&gt; 'v1/teste',
                      'extraPatterns' =&gt; [
                              'GET testando' =&gt; 'testando',
                          ],
                  ],
                  [
                      'class' =&gt; 'yii\rest\UrlRule',
                      'controller' =&gt; 'v1/user',
                      'extraPatterns' =&gt; [
                              'GET login' =&gt; 'login',
                          ],
                  ],
                  'OPTIONS v1/user/login' =&gt; 'v1/user/login',
                  'POST v1/user/login' =&gt; 'v1/user/login',
              ],        
          ]
      ],
      'params' =&gt; $params,
  ];
  </code></pre>
  
  <p>--> modules --> v1 --> controllers --> TesteController.php</p>
  
  <pre><code>&lt;?php
  
  namespace api\modules\v1\controllers;
  
  //Formato json
  use yii\filters\ContentNegotiator;
  use yii\web\Response;
  
  //Banco de dados
  use yii\db\ActiveRecord;
  
  //Segurança
  use yii\filters\auth\CompositeAuth;
  use yii\filters\auth\QueryParamAuth;
  
  //Rest api
  use yii\rest\ActiveController;
  
  /**
   * Country Controller API
   *
   * @author Budi Irawan &lt;deerawan@gmail.com&gt;
   */
  class TesteController extends ActiveController
  {
      public $modelClass = 'api\modules\v1\models\Teste';
  
      public function behaviors()
      {
          $behaviors = parent::behaviors();
          $behaviors['authenticator'] = [
              'class' =&gt; QueryParamAuth::className(),
          ];
          $behaviors['bootstrap'] = [
              'class' =&gt; ContentNegotiator::className(),
          'formats' =&gt; [
              'application/json' =&gt; Response::FORMAT_JSON,
          ],
      ];  
          return $behaviors;  
      }
  
      public function actionTestando(){
      echo "testado";
      }
  }
  </code></pre>
  
  <p>--> modules --> v1 --> controllers --> UserController.php</p>
  
  <pre><code>&lt;?php
  namespace api\modules\v1\controllers;
  
  use common\models\LoginForm;
  use yii\rest\ActiveController;
  
  class UserController extends ActiveController
  {
      public $modelClass = 'common\models\User';
  
      public function actionLogin()
      {
          $model = new LoginForm();
  
          if ($model-&gt;load(\Yii::$app-&gt;getRequest()-&gt;getBodyParams(), '') &amp;&amp; $model-&gt;login()) {
              echo \Yii::$app-&gt;user-&gt;identity-&gt;getAuthKey();
          } else {
              return $model;
          }
      }
  
      public function actionIndex()
      {
          if (\Yii::$app-&gt;user-&gt;isGuest) {
              throw new \HttpHeaderException();
          }
          return \Yii::$app-&gt;user-&gt;getId();
      }
  }
  </code></pre>
  
  <p>--> modules --> v1 --> models --> Teste.php</p>
  
  <pre><code>&lt;?php
  
  namespace api\modules\v1\models;
  
  use yii\behaviors\TimestampBehavior;
  
  use \yii\db\ActiveRecord;
  
  class Teste extends ActiveRecord 
  {
      /**
       * @inheritdoc
       */
      public static function tableName()
      {
          return '{{%teste}}';
      }
  
      /**
       * @inheritdoc
       */
      public function behaviors()
      {
          return [
              TimestampBehavior::className(),
          ];
      }
  }
  </code></pre>
  
  <p>--> modules --> v1 --> models --> User.php</p>
  
  <pre><code>&lt;?php
  
  namespace api\modules\v1\models;
  
  use common\models\User as CommonUser;
  
  class User extends CommonUser
  {
  
  }
  </code></pre>
  
  <p>--> modules --> v1 --> Module.php</p>
  
  <pre><code>&lt;?php
  namespace api\modules\v1;
  
  class Module extends \yii\base\Module
  {
      public $controllerNamespace = 'api\modules\v1\controllers';
  
      public function init()
      {
          parent::init();        
      }
  }
  </code></pre>
  
  <p>Then when I'm testing the REST API with:</p>
  
  <pre><code>curl -D- -u admin:123mudar! -H "Content-Type:application/json" 'http://www.domain.com/v1/testa/api/web/v1/testes'
  </code></pre>
  
  <p>I've got:</p>
  
  <pre><code>HTTP/1.1 401 Unauthorized
  Date: Mon, 18 Aug 2014 22:44:10 GMT
  Server: Apache
  Transfer-Encoding: chunked
  Content-Type: application/json; charset=UTF-8
  
  {"type":"yii\\web\\UnauthorizedHttpException","name":"Unauthorized","message":"You are requesting with an invalid access token.","code":0,"status":401}
  </code></pre>
  
  <p>Even when I'm using the restClient plugin. What is missing?</p>
  
  <p>Database table structure:</p>
  
  <pre><code>CREATE TABLE IF NOT EXISTS `teste` (
    `codigo` int(11) NOT NULL AUTO_INCREMENT,
    `nome` varchar(100) NOT NULL,
    PRIMARY KEY (`codigo`),
    KEY `nome` (`nome`)
  ) ENGINE=MyISAM  DEFAULT CHARSET=utf8 AUTO_INCREMENT=3 ;
  
  INSERT INTO `teste` (`codigo`, `nome`) VALUES
  (1, 'valor 1'),
  (2, 'valor 2');
  
  CREATE TABLE IF NOT EXISTS `user` (
    `id` int(11) NOT NULL AUTO_INCREMENT,
    `username` varchar(255) NOT NULL,
    `auth_key` varchar(32) NOT NULL,
    `password_hash` varchar(255) NOT NULL,
    `password_reset_token` varchar(255) DEFAULT NULL,
    `email` varchar(255) NOT NULL,
    `role` smallint(6) NOT NULL DEFAULT '10',
    `status` smallint(6) NOT NULL DEFAULT '10',
    `created_at` int(11) NOT NULL,
    `updated_at` int(11) NOT NULL,
    PRIMARY KEY (`id`)
  ) ENGINE=InnoDB  DEFAULT CHARSET=utf8 AUTO_INCREMENT=2 ;
  
  
  INSERT INTO `user` (`id`, `username`, `auth_key`, `password_hash`, `password_reset_token`, `email`, `role`, `status`, `created_at`, `updated_at`) VALUES
  (1, 'admin', '79UF7P3XNV9t075lv1kA8G3mYVaysaIw', '$2y$13$A8x5bNgFSwyN6RTFtgZ2h.oGu87gWqiRrci/jZYzT.KwF6o6sLTzC', NULL, 'admin@admin.com', 10, 10, 1408061655, 1408061655);
  </code></pre>