Class SecurityComponent

The Security Component creates an easy way to integrate tighter security in your application. It provides methods for various tasks like:

Restricting which HTTP methods your application accepts.
CSRF protection.
Form tampering protection
Requiring that SSL be used.
Limiting cross controller communication.

Object

Component

SecurityComponent

Package: Cake\Controller\Component
Link: http://book.cakephp.org/2.0/en/core-libraries/components/security-component.html
Copyright: Copyright (c) Cake Software Foundation, Inc. (http://cakefoundation.org)
License: MIT License
Location: Cake/Controller/Component/SecurityComponent.php

Properties summary

$_action protected

string

Holds the current action of the controller
$allowedActions public

array

Actions from which actions of the current controller are allowed to receive requests.
$allowedControllers public

array

Controllers from which actions of the current controller are allowed to receive requests.
$blackHoleCallback public

string

The controller method that will be called if this request is black-hole'd
$components public

array

Other components used by the Security component
$csrfCheck public

boolean

Whether to use CSRF protected forms. Set to false to disable CSRF protection on forms.
$csrfExpires public

string

The duration from when a CSRF token is created that it will expire on. Each form/page request will generate a new token that can only be submitted once unless it expires. Can be any value compatible with strtotime()
$csrfLimit public

integer

Control the number of tokens a user can keep open. This is most useful with one-time use tokens. Since new tokens are created on each request, having a hard limit on the number of open tokens can be useful in controlling the size of the session file.
$csrfUseOnce public

boolean

Controls whether or not CSRF tokens are use and burn. Set to false to not generate new tokens on each request. One token will be reused until it expires. This reduces the chances of users getting invalid requests because of token consumption. It has the side effect of making CSRF less secure, as tokens are reusable.
$disabledFields public

array

Deprecated property, superseded by unlockedFields.
$request public

CakeRequest

Request object
$requireAuth public

array

List of actions that require a valid authentication key
$requireDelete public

array

List of controller actions for which a DELETE request is required
$requireGet public

array

List of controller actions for which a GET request is required
$requirePost public

array

List of controller actions for which a POST request is required
$requirePut public

array

List of controller actions for which a PUT request is required
$requireSecure public

array

List of actions that require an SSL-secured connection
$unlockedActions public

array

Actions to exclude from CSRF and POST validation checks. Other checks like requireAuth(), requireSecure(), requirePost(), requireGet() etc. will still be applied.
$unlockedFields public

array

Form fields to exclude from POST validation. Fields can be unlocked either in the Component, or with FormHelper::unlockField(). Fields that have been unlocked are not required to be part of the POST and hidden unlocked fields do not have their values checked.
$validatePost public

boolean

Whether to validate POST data. Set to false to disable for data coming from 3rd party services, etc.

Inherited Properties

_Collection, _componentMap, settings

Method Summary

_authRequired() protected

Check if authentication is required
_callback() protected

Calls a controller callback method
_expireTokens() protected

Expire CSRF nonces and remove them from the valid tokens. Uses a simple timeout to expire the tokens.
_methodsRequired() protected

Check if HTTP methods are required
_requireMethod() protected

Sets the actions that require a $method HTTP request, or empty for all actions
_secureRequired() protected

Check if access requires secure connection
_validateCsrf() protected

Validate that the controller has a CSRF token in the POST data and that the token is legit/not expired. If the token is valid it will be removed from the list of valid tokens.
_validatePost() protected

Validate submitted form
blackHole() public

Black-hole an invalid request with a 400 error or custom callback. If SecurityComponent::$blackHoleCallback is specified, it will use this callback by executing the method indicated in $error
generateToken() public

Manually add CSRF token information into the provided request object.
requireAuth() public

Sets the actions that require whitelisted form submissions.
requireDelete() public deprecated

Sets the actions that require a DELETE request, or empty for all actions
requireGet() public deprecated

Sets the actions that require a GET request, or empty for all actions
requirePost() public deprecated

Sets the actions that require a POST request, or empty for all actions
requirePut() public deprecated

Sets the actions that require a PUT request, or empty for all actions
requireSecure() public

Sets the actions that require a request that is SSL-secured, or empty for all actions
startup() public

Component startup. All security checking happens here.

Method Detail

_authRequired() protected ¶

_authRequired( Controller $controller )

Check if authentication is required

Parameters

Controller $controller: Instantiating controller

Returns

boolean
true if authentication required

_callback() protected ¶

_callback( Controller $controller , string $method , array $params = array() )

Calls a controller callback method

Parameters

Controller $controller: Controller to run callback on
string $method: Method to execute
array $params optional array(): Parameters to send to method

Returns

mixed
Controller callback method's response

Throws

BadRequestException
When a the blackholeCallback is not callable.

_expireTokens() protected ¶

_expireTokens( array $tokens )

Expire CSRF nonces and remove them from the valid tokens. Uses a simple timeout to expire the tokens.

Parameters

array $tokens: An array of nonce => expires.

Returns

array
An array of nonce => expires.

_methodsRequired() protected ¶

_methodsRequired( Controller $controller )

Check if HTTP methods are required

Parameters

Controller $controller: Instantiating controller

Returns

boolean
true if $method is required

_requireMethod() protected ¶

_requireMethod( string $method , array $actions = array() )

Sets the actions that require a $method HTTP request, or empty for all actions

Parameters

string $method: The HTTP method to assign controller actions to
array $actions optional array(): Controller actions to set the required HTTP method to.

_secureRequired() protected ¶

_secureRequired( Controller $controller )

Check if access requires secure connection

Parameters

Controller $controller: Instantiating controller

Returns

boolean
true if secure connection required

_validateCsrf() protected ¶

_validateCsrf( Controller $controller )

Validate that the controller has a CSRF token in the POST data and that the token is legit/not expired. If the token is valid it will be removed from the list of valid tokens.

Parameters

Controller $controller: A controller to check

Returns

boolean
Valid csrf token.

_validatePost() protected ¶

_validatePost( Controller $controller )

Validate submitted form

Parameters

Controller $controller: Instantiating controller

Returns

boolean
true if submitted form is valid

blackHole() public ¶

blackHole( Controller $controller , string $error = '' )

Black-hole an invalid request with a 400 error or custom callback. If SecurityComponent::$blackHoleCallback is specified, it will use this callback by executing the method indicated in $error

Parameters

Controller $controller: Instantiating controller
string $error optional '': Error method

Returns

mixed
If specified, controller blackHoleCallback's response, or no return otherwise

Throws

BadRequestException

See

SecurityComponent::$blackHoleCallback

Link

http://book.cakephp.org/2.0/en/core-libraries/components/security-component.html#handling-blackhole-callbacks

generateToken() public ¶

generateToken( CakeRequest $request )

Manually add CSRF token information into the provided request object.

Parameters

CakeRequest $request: The request object to add into.

Returns

boolean

requireAuth() public ¶

requireAuth( )

Sets the actions that require whitelisted form submissions.

Adding actions with this method will enforce the restrictions set in SecurityComponent::$allowedControllers and SecurityComponent::$allowedActions.

Link

http://book.cakephp.org/2.0/en/core-libraries/components/security-component.html#SecurityComponent::requireAuth

requireDelete() public deprecated ¶

requireDelete( )

Sets the actions that require a DELETE request, or empty for all actions

Deprecated

Use CakeRequest::onlyAllow() instead.

requireGet() public deprecated ¶

requireGet( )

Sets the actions that require a GET request, or empty for all actions

Deprecated

Use CakeRequest::onlyAllow() instead.

requirePost() public deprecated ¶

requirePost( )

Sets the actions that require a POST request, or empty for all actions

Deprecated

Use CakeRequest::onlyAllow() instead.

Link

http://book.cakephp.org/2.0/en/core-libraries/components/security-component.html#SecurityComponent::requirePost

requirePut() public deprecated ¶

requirePut( )

Sets the actions that require a PUT request, or empty for all actions

Deprecated

Use CakeRequest::onlyAllow() instead.

requireSecure() public ¶

requireSecure( )

Sets the actions that require a request that is SSL-secured, or empty for all actions

Link

http://book.cakephp.org/2.0/en/core-libraries/components/security-component.html#SecurityComponent::requireSecure

startup() public ¶

startup( Controller $controller )

Component startup. All security checking happens here.

Parameters

Controller $controller: Instantiating controller

Overrides

Component::startup()

Methods inherited from Component

__construct() public ¶

__construct( ComponentCollection $collection , array $settings = array() )

Constructor

Parameters

ComponentCollection $collection: A ComponentCollection this component can use to lazy load its components
array $settings optional array(): Array of configuration settings.

Overrides

Object::__construct()

__get() public ¶

__get( string $name )

Magic method for lazy loading $components.

Parameters

string $name: Name of component to get.

Returns

mixed
A Component object or null.

beforeRedirect() public ¶

beforeRedirect( Controller $controller , string|array $url , integer $status = null , boolean $exit = true )

Called before Controller::redirect(). Allows you to replace the URL that will be redirected to with a new URL. The return of this method can either be an array or a string.

If the return is an array and contains a 'url' key. You may also supply the following:

status The status code for the redirect
exit Whether or not the redirect should exit.

If your response is a string or an array that does not contain a 'url' key it will be used as the new URL to redirect to.

Parameters

Controller $controller: Controller with components to beforeRedirect
string|array $url: Either the string or URL array that is being redirected to.
integer $status optional null: The status code of the redirect
boolean $exit optional true: Will the script exit.

Returns

array|
Either an array or null.

Link

http://book.cakephp.org/2.0/en/controllers/components.html#Component::beforeRedirect

beforeRender() public ¶

beforeRender( Controller $controller )

Called before the Controller::beforeRender(), and before the view class is loaded, and before Controller::render()

Parameters

Controller $controller: Controller with components to beforeRender

Link

http://book.cakephp.org/2.0/en/controllers/components.html#Component::beforeRender

initialize() public ¶

initialize( Controller $controller )

Called before the Controller::beforeFilter().

Parameters

Controller $controller: Controller with components to initialize

Link

http://book.cakephp.org/2.0/en/controllers/components.html#Component::initialize

shutdown() public ¶

shutdown( Controller $controller )

Called after Controller::render() and before the output is printed to the browser.

Parameters

Controller $controller: Controller with components to shutdown

Link

http://book.cakephp.org/2.0/en/controllers/components.html#Component::shutdown

Methods inherited from Object

_mergeVars() protected ¶

_mergeVars( array $properties , string $class , boolean $normalize = true )

Merges this objects $property with the property in $class' definition. This classes value for the property will be merged on top of $class'

This provides some of the DRY magic CakePHP provides. If you want to shut it off, redefine this method as an empty function.

Parameters

array $properties: The name of the properties to merge.
string $class: The class to merge the property with.
boolean $normalize optional true: Set to true to run the properties through Hash::normalize() before merging.

_set() protected ¶

_set( array $properties = array() )

Allows setting of multiple properties of the object in a single line of code. Will only set properties that are part of a class declaration.

Parameters

array $properties optional array(): An associative array containing properties and corresponding values.

_stop() protected ¶

_stop( integer|string $status = 0 )

Stop execution of the current script. Wraps exit() making testing easier.

Parameters

integer|string $status optional 0: see http://php.net/exit for values

dispatchMethod() public ¶

dispatchMethod( string $method , array $params = array() )

Calls a method on this object with the given parameters. Provides an OO wrapper for call_user_func_array

Parameters

string $method: Name of the method to call
array $params optional array(): Parameter list to use when calling $method

Returns

mixed
Returns the result of the method call

log() public ¶

log( string $msg , integer|string $type = LOG_ERR )

Convenience method to write a message to CakeLog. See CakeLog::write() for more information on writing to logs.

Parameters

string $msg: Log message.
integer|string $type optional LOG_ERR: Type of message being written. Either a valid LOG_* constant or a string matching the recognized levels.

Returns

boolean
Success of log write.

See

CakeLog::write()

requestAction() public ¶

requestAction( string|array $url , array $extra = array() )

Calls a controller's method from any location. Can be used to connect controllers together or tie plugins into a main application. requestAction can be used to return rendered views or fetch the return value from controller actions.

Under the hood this method uses Router::reverse() to convert the $url parameter into a string URL. You should use URL formats that are compatible with Router::reverse()

Passing POST and GET data

POST and GET data can be simulated in requestAction. Use $extra['url'] for GET data. The $extra['data'] parameter allows POST data simulation.

Parameters

string|array $url: String or array-based URL. Unlike other URL arrays in CakePHP, this URL will not automatically handle passed and named arguments in the $url parameter.
array $extra optional array(): if array includes the key "return" it sets the AutoRender to true. Can also be used to submit GET/POST data, and named/passed arguments.

Returns

mixed

Boolean true or false on success/failure, or contents of rendered action if 'return' is set in $extra.

toString() public ¶

toString( )

Object-to-string conversion. Each class can override this method as necessary.

Returns

string
The name of this class

Properties detail

`$_action` ¶

protected string

Holds the current action of the controller

null

`$allowedActions` ¶

public array

Actions from which actions of the current controller are allowed to receive requests.

See

SecurityComponent::requireAuth()

array()

`$allowedControllers` ¶

public array

Controllers from which actions of the current controller are allowed to receive requests.

See

SecurityComponent::requireAuth()

array()

`$blackHoleCallback` ¶

public string

The controller method that will be called if this request is black-hole'd

null

`$components` ¶

public array

Other components used by the Security component

array('Session')

`$csrfCheck` ¶

public boolean

Whether to use CSRF protected forms. Set to false to disable CSRF protection on forms.

See

http://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)
SecurityComponent::$csrfExpires

true

`$csrfExpires` ¶

public string

The duration from when a CSRF token is created that it will expire on. Each form/page request will generate a new token that can only be submitted once unless it expires. Can be any value compatible with strtotime()

'+30 minutes'

`$csrfLimit` ¶

public integer

Control the number of tokens a user can keep open. This is most useful with one-time use tokens. Since new tokens are created on each request, having a hard limit on the number of open tokens can be useful in controlling the size of the session file.

When tokens are evicted, the oldest ones will be removed, as they are the most likely to be dead/expired.

`$csrfUseOnce` ¶

public boolean

Controls whether or not CSRF tokens are use and burn. Set to false to not generate new tokens on each request. One token will be reused until it expires. This reduces the chances of users getting invalid requests because of token consumption. It has the side effect of making CSRF less secure, as tokens are reusable.

true

`$disabledFields` ¶

public array

Deprecated property, superseded by unlockedFields.

Deprecated

See

SecurityComponent::$unlockedFields

array()

`$request` ¶

public CakeRequest

Request object

`$requireAuth` ¶

public array

List of actions that require a valid authentication key

See

SecurityComponent::requireAuth()

array()

`$requireDelete` ¶

public array

List of controller actions for which a DELETE request is required

Deprecated

Use CakeRequest::onlyAllow() instead.

See

SecurityComponent::requireDelete()

array()

`$requireGet` ¶

public array

List of controller actions for which a GET request is required

Deprecated

Use CakeRequest::onlyAllow() instead.

See

SecurityComponent::requireGet()

array()

`$requirePost` ¶

public array

List of controller actions for which a POST request is required

Deprecated

Use CakeRequest::onlyAllow() instead.

See

SecurityComponent::requirePost()

array()

`$requirePut` ¶

public array

List of controller actions for which a PUT request is required

Deprecated

Use CakeRequest::onlyAllow() instead.

See

SecurityComponent::requirePut()

array()

`$requireSecure` ¶

public array

List of actions that require an SSL-secured connection

See

SecurityComponent::requireSecure()

array()

`$unlockedActions` ¶

public array

Actions to exclude from CSRF and POST validation checks. Other checks like requireAuth(), requireSecure(), requirePost(), requireGet() etc. will still be applied.

array()

`$unlockedFields` ¶

public array

Form fields to exclude from POST validation. Fields can be unlocked either in the Component, or with FormHelper::unlockField(). Fields that have been unlocked are not required to be part of the POST and hidden unlocked fields do not have their values checked.

array()

`$validatePost` ¶

public boolean

Whether to validate POST data. Set to false to disable for data coming from 3rd party services, etc.

true

Packages

Classes

Class SecurityComponent

Properties summary

Inherited Properties

Method Summary

_authRequired() protected

_callback() protected

_expireTokens() protected

_methodsRequired() protected

_requireMethod() protected

_secureRequired() protected

_validateCsrf() protected

_validatePost() protected

blackHole() public

generateToken() public

requireAuth() public

requireDelete() public deprecated

requireGet() public deprecated

requirePost() public deprecated

requirePut() public deprecated

requireSecure() public

startup() public

Method Detail

_authRequired() protected ¶

Parameters

Returns

_callback() protected ¶

Parameters

Returns

Throws

_expireTokens() protected ¶

Parameters

Returns

_methodsRequired() protected ¶

Parameters

Returns

_requireMethod() protected ¶

Parameters

_secureRequired() protected ¶

Parameters

Returns

_validateCsrf() protected ¶

Parameters

Returns

_validatePost() protected ¶

Parameters

Returns

blackHole() public ¶

Parameters

Returns

Throws

See

Link

generateToken() public ¶

Parameters

Returns

requireAuth() public ¶

Link

requireDelete() public deprecated ¶

Deprecated

requireGet() public deprecated ¶

Deprecated

requirePost() public deprecated ¶

Deprecated

Link

requirePut() public deprecated ¶

Deprecated

requireSecure() public ¶

Link

startup() public ¶

Parameters

Overrides

Methods inherited from Component

__construct() public ¶

Parameters

Overrides

__get() public ¶

Parameters

Returns