framework/web/User.php
protected function beforeLogin($identity, $cookieBased, $duration)
    {
        $event = new UserEvent([
            'identity' => $identity,
            'cookieBased' => $cookieBased,
            'duration' => $duration,
        ]);
        $this->trigger(self::EVENT_BEFORE_LOGIN, $event);

        return $event->isValid;
    }
protected function beforeLogin($identity, $cookieBased, $duration)
    {
        $event = new UserEvent([
            'identity' => $identity,
            'cookieBased' => $cookieBased,
            'duration' => $duration,
        ]);
        $this->trigger(self::EVENT_BEFORE_LOGIN, $event);

        return $event->isValid;
    }
This method is called before logging in a user.
The default implementation will trigger the [[EVENT_BEFORE_LOGIN]] event.
If you override this method, make sure you call the parent implementation
so that the event is triggered.
@param IdentityInterface $identity the user identity information
@param bool $cookieBased whether the login is cookie-based
@param int $duration number of seconds that the user can remain in logged-in status.
If 0, it means login till the user closes the browser or the session is manually destroyed.
@return bool whether the user should continue to be logged in