User authentication system
Connection


Is just wrapping PDO in a class Connection.
Contains hard-coded credentials.


This class provides no significant benefit over using the PDO class directly. If somehow you need to change the database credentials, you'll have to change the class' properties directly, which is also a bad thing.

I suggest you get rid of your Connection class and just stick to using the PDO class directly. It already provides everything you need.



User

Just an anemic domain object with a bunch of getters and setters. I don't see anything wrong with that.



UserService


Violates the Single Responsibility Principle.

This class serves to:


Authenticate Users.
Register Users.
Write / read from the database.



I would transform it into 3 application service classes and give them all their own responsibility:


AuthenticationService:

This will serve to authenticate Users so it contains the following methods: 


Find logged in User.
Log in.
Log out.

RegistrationService:

This class will take care of your User domain object registrations and contains the following method:


Register User. 

And finally UserMapper:

This class will contain all the CRUD operations for your domain object User, and it will spit out User domain objects when reading from the database. It will contain the methods:


Find user by ID.
Find user by Email.






  Is this right according to the MVC model?


Hmm, not really. You're missing the dedicated Views and Controllers of the M V C pattern.

From what I see, you've got responsibilities of the View mixed with your code on the bootstrap level. The logic of which you are controlling the model classes with is supposed to be in a dedicated Controller. And the logic of what you output to the browser needs to be in it's corresponding View.

Btw, the 3 classes I've discussed above are supposed to reside in the Model layer in your MVC structure because they contain business and application logic ( = model).

Blueprint of a potential controller:

// declare namespace

// import statements

class AuthController
{
    // dependencies

    public function __construct(AuthService $authService, View $view)
    {
        // set the dependencies
    }

    public function index()
    {
        return $this-&gt;view-&gt;index()
    }

    public function submit()
    {
        if ($user = $this-&gt;authService-&gt;logInUser('foo@bar.nl', 'password')) {
            return $this-&gt;view-&gt;success([
                'user' =&gt; [
                    'email' =&gt; $user-&gt;getEmail()
                ]
            ]);
        }

        return $this-&gt;view-&gt;failed();
    }

    // log out action
}


Note: In the original MVC pattern the Controller is not supposed to call or instantiate any views, but solely control the Model layer, nothing else. However, over the years this has changed. Nowadays what you'll mostly see and hear is that a Controller's job is to control the model layer and call / return the appropriate View.



Wrapping up

Luckily your code is not in a super bad state. All it needs is some refactoring and restructuring to make it valid according to the MVC pattern and abide by the separation of concerns.

Try to adhere to the coding standards defined by the PHP Framework Interop Group. It gives better readability to your code, especially for other programmers who do it as well. Of course, you do not have to be perfect with it.

I hope my answer is clear enough and of some help to you. :)