src/web/User.php
public function loginRequired($checkAjax = true)
    {
        $request = Yii::$app->getRequest();
        if ($this->enableSession && (!$checkAjax || !$request->getIsAjax())) {
            $this->setReturnUrl($request->getUrl());
        }
        if ($this->loginUrl !== null) {
            $loginUrl = (array) $this->loginUrl;
            if ($loginUrl[0] !== Yii::$app->requestedRoute) {
                return Yii::$app->getResponse()->redirect($this->loginUrl);
            }
        }
        throw new ForbiddenHttpException(Yii::t('yii', 'Login Required'));
    }
public function loginRequired($checkAjax = true)
    {
        $request = Yii::$app->getRequest();
        if ($this->enableSession && (!$checkAjax || !$request->getIsAjax())) {
            $this->setReturnUrl($request->getUrl());
        }
        if ($this->loginUrl !== null) {
            $loginUrl = (array) $this->loginUrl;
            if ($loginUrl[0] !== Yii::$app->requestedRoute) {
                return Yii::$app->getResponse()->redirect($this->loginUrl);
            }
        }
        throw new ForbiddenHttpException(Yii::t('yii', 'Login Required'));
    }
Redirects the user browser to the login page.

Before the redirection, the current URL (if it's not an AJAX url) will be kept as [[returnUrl]] so that
the user browser may be redirected back to the current page after successful login.

Make sure you set [[loginUrl]] so that the user browser can be redirected to the specified login URL after
calling this method.

Note that when [[loginUrl]] is set, calling this method will NOT terminate the application execution.

@param boolean $checkAjax whether to check if the request is an AJAX request. When this is true and the request
is an AJAX request, the current URL (for AJAX request) will NOT be set as the return URL.
@return Response the redirection response if [[loginUrl]] is set
@throws ForbiddenHttpException the "Access Denied" HTTP exception if [[loginUrl]] is not set