Class SecurityComponent

Constants summary

• string
  DEFAULT_EXCEPTION_MESSAGE ¶
  'The request has been black-holed'

Properties summary

• $_action protected
  string
  Holds the current action of the controller
• $allowedActions public
  array

  Actions from which actions of the current controller are allowed to receive requests.

• $allowedControllers public
  array

  Controllers from which actions of the current controller are allowed to receive requests.

• $blackHoleCallback public
  string
  The controller method that will be called if this request is black-hole'd
• $components public
  array
  Other components used by the Security component
• $csrfCheck public
  boolean
  Whether to use CSRF protected forms. Set to false to disable CSRF protection on forms.
• $csrfExpires public
  string

  The duration from when a CSRF token is created that it will expire on. Each form/page request will generate a new token that can only be submitted once unless it expires. Can be any value compatible with strtotime()

• $csrfLimit public
  integer

  Control the number of tokens a user can keep open. This is most useful with one-time use tokens. Since new tokens are created on each request, having a hard limit on the number of open tokens can be useful in controlling the size of the session file.

• $csrfUseOnce public
  boolean

  Controls whether or not CSRF tokens are use and burn. Set to false to not generate new tokens on each request. One token will be reused until it expires. This reduces the chances of users getting invalid requests because of token consumption. It has the side effect of making CSRF less secure, as tokens are reusable.

• $disabledFields public
  array
  Deprecated property, superseded by unlockedFields.
• $request public
  CakeRequest
  Request object
• $requireAuth public
  array
  List of actions that require a valid authentication key
• $requireDelete public
  array
  List of controller actions for which a DELETE request is required
• $requireGet public
  array
  List of controller actions for which a GET request is required
• $requirePost public
  array
  List of controller actions for which a POST request is required
• $requirePut public
  array
  List of controller actions for which a PUT request is required
• $requireSecure public
  array
  List of actions that require an SSL-secured connection
• $unlockedActions public
  array

  Actions to exclude from CSRF and POST validation checks. Other checks like requireAuth(), requireSecure(), requirePost(), requireGet() etc. will still be applied.

• $unlockedFields public
  array

  Form fields to exclude from POST validation. Fields can be unlocked either in the Component, or with FormHelper::unlockField(). Fields that have been unlocked are not required to be part of the POST and hidden unlocked fields do not have their values checked.

• $validatePost public
  boolean

  Whether to validate POST data. Set to false to disable for data coming from 3rd party services, etc.

Inherited Properties

• _Collection, _componentMap, settings

Method Summary

• _authRequired() protected deprecated

  Check if authentication is required

• _callback() protected

  Calls a controller callback method

• _debugCheckFields() protected

  Iterates data array to check against expected

• _debugExpectedFields() protected

  Generate debug message for the expected fields

• _debugPostTokenNotMatching() protected

  Create a message for humans to understand why Security token is not matching

• _expireTokens() protected

  Expire CSRF nonces and remove them from the valid tokens. Uses a simple timeout to expire the tokens.

• _fieldsList() protected

  Return the fields list for the hash calculation

• _hashParts() protected

  Return hash parts for the Token generation

• _matchExistingFields() protected

  Generate array of messages for the existing fields in POST data, matching dataFields in $expectedFields will be unset

• _methodsRequired() protected

  Check if HTTP methods are required

• _requireMethod() protected

  Sets the actions that require a $method HTTP request, or empty for all actions

• _secureRequired() protected

  Check if access requires secure connection

• _sortedUnlocked() protected

  Get the sorted unlocked string

• _throwException() protected

  Check debug status and throw an Exception based on the existing one

• _unlocked() protected

  Get the unlocked string

• _validToken() protected

  Check if token is valid

• _validateCsrf() protected

  Validate that the controller has a CSRF token in the POST data and that the token is legit/not expired. If the token is valid it will be removed from the list of valid tokens.

• _validatePost() protected

  Validate submitted form

• blackHole() public

  Black-hole an invalid request with a 400 error or custom callback. If SecurityComponent::$blackHoleCallback is specified, it will use this callback by executing the method indicated in $error

• generateToken() public

  Manually add CSRF token information into the provided request object.

• requireAuth() public

  Sets the actions that require whitelisted form submissions.

• requireDelete() public deprecated

  Sets the actions that require a DELETE request, or empty for all actions

• requireGet() public deprecated

  Sets the actions that require a GET request, or empty for all actions

• requirePost() public deprecated

  Sets the actions that require a POST request, or empty for all actions

• requirePut() public deprecated

  Sets the actions that require a PUT request, or empty for all actions

• requireSecure() public

  Sets the actions that require a request that is SSL-secured, or empty for all actions

• startup() public

  Component startup. All security checking happens here.

Method Detail

Methods inherited from Component

Methods inherited from CakeObject

Properties detail

null

array()

array()

null

array('Session')

true

'+30 minutes'

100

true

array()

array()

array()

array()

array()

array()

array()

array()

array()

true