Class SecurityComponent
The Security Component creates an easy way to integrate tighter security in your application. It provides methods for various tasks like:
- Restricting which HTTP methods your application accepts.
- Form tampering protection
- Requiring that SSL be used.
- Limiting cross controller communication.
Link: http://book.cakephp.org/3.0/en/controllers/components/security.html
Property Summary
-
$_action protected
stringHolds the current action of the controller
-
$_componentMap protected
arrayA component lookup table used to lazy load component objects.
-
$_config protected
arrayRuntime config
-
$_configInitialized protected
boolWhether the config property has already been configured with defaults
-
$_defaultConfig protected
arrayDefault config
-
$_registry protected
Cake\Controller\ComponentRegistryComponent registry class used to lazy load components.
-
$components public
arrayOther Components this component uses.
-
$request public
Cake\Network\RequestRequest object
-
$response public
Cake\Network\ResponseResponse object
-
$session public
Cake\Network\SessionThe Session object
Method Summary
-
__construct() public
Constructor
-
__debugInfo() public
Returns an array that can be used to describe the internal state of this object.
-
__get() public
Magic method for lazy loading $components.
-
_authRequired() protected
Check if authentication is required
-
_callback() protected
Calls a controller callback method
-
_configDelete() protected
Delete a single config key
-
_configRead() protected
Read a config variable
-
_configWrite() protected
Write a config variable
-
_requireMethod() protected
Sets the actions that require a $method HTTP request, or empty for all actions
-
_secureRequired() protected
Check if access requires secure connection
-
_validatePost() protected
Validate submitted form
-
blackHole() public
Black-hole an invalid request with a 400 error or custom callback. If SecurityComponent::$blackHoleCallback is specified, it will use this callback by executing the method indicated in $error
-
config() public
Usage
-
configShallow() public
Merge provided config with existing config. Unlike
config()which does a recursive merge for nested keys, this method does a simple merge. -
generateToken() public
Manually add form tampering prevention token information into the provided request object.
-
implementedEvents() public
Events supported by this component.
-
initialize() public
Constructor hook method.
-
log() public
Convenience method to write a message to Log. See Log::write() for more information on writing to logs.
-
requireAuth() public
Sets the actions that require whitelisted form submissions.
-
requireSecure() public
Sets the actions that require a request that is SSL-secured, or empty for all actions
-
startup() public
Component startup. All security checking happens here.
Method Detail
__construct() ¶ public
__construct(ComponentRegistry $registry, array $config = [])Constructor
Parameters
-
ComponentRegistry$registry A ComponentRegistry this component can use to lazy load its components
-
array$config optional Array of configuration settings.
__debugInfo() ¶ public
__debugInfo(): arrayReturns an array that can be used to describe the internal state of this object.
Returns
array__get() ¶ public
__get(string $name): mixedMagic method for lazy loading $components.
Parameters
-
string$name Name of component to get.
Returns
mixed_authRequired() ¶ protected
_authRequired(Controller $controller): boolCheck if authentication is required
Parameters
-
Controller$controller Instantiating controller
Returns
bool_callback() ¶ protected
_callback(Controller $controller, string $method, array $params = []): mixedCalls a controller callback method
Parameters
-
Controller$controller Controller to run callback on
-
string$method Method to execute
-
array$params optional Parameters to send to method
Returns
mixedThrows
Cake\Network\Exception\BadRequestExceptionWhen a the blackholeCallback is not callable.
_configDelete() ¶ protected
_configDelete(string $key): voidDelete a single config key
Parameters
-
string$key Key to delete.
Returns
voidThrows
Cake\Core\Exception\Exceptionif attempting to clobber existing config
_configRead() ¶ protected
_configRead(string|null $key): mixedRead a config variable
Parameters
-
string|null$key Key to read.
Returns
mixed_configWrite() ¶ protected
_configWrite(string|array $key, mixed $value, bool|string $merge = false): voidWrite a config variable
Parameters
-
string|array$key Key to write to.
-
mixed$value Value to write.
-
bool|string$merge optional True to merge recursively, 'shallow' for simple merge, false to overwrite, defaults to false.
Returns
voidThrows
Cake\Core\Exception\Exceptionif attempting to clobber existing config
_requireMethod() ¶ protected
_requireMethod(string $method, array $actions = []): voidSets the actions that require a $method HTTP request, or empty for all actions
Parameters
-
string$method The HTTP method to assign controller actions to
-
array$actions optional Controller actions to set the required HTTP method to.
Returns
void_secureRequired() ¶ protected
_secureRequired(Controller $controller): boolCheck if access requires secure connection
Parameters
-
Controller$controller Instantiating controller
Returns
bool_validatePost() ¶ protected
_validatePost(Controller $controller): boolValidate submitted form
Parameters
-
Controller$controller Instantiating controller
Returns
boolblackHole() ¶ public
blackHole(Controller $controller, string $error = ''): mixedBlack-hole an invalid request with a 400 error or custom callback. If SecurityComponent::$blackHoleCallback is specified, it will use this callback by executing the method indicated in $error
Parameters
-
Controller$controller Instantiating controller
-
string$error optional Error method
Returns
mixedThrows
Cake\Network\Exception\BadRequestExceptionSee Also
Links
config() ¶ public
config(string|array|null $key = null, mixed|null $value = null, bool $merge = true): mixedUsage
Reading the whole config:
$this->config();Reading a specific value:
$this->config('key');Reading a nested value:
$this->config('some.nested.key');Setting a specific value:
$this->config('key', $value);Setting a nested value:
$this->config('some.nested.key', $value);Updating multiple config settings at the same time:
$this->config(['one' => 'value', 'another' => 'value']);Parameters
-
string|array|null$key optional The key to get/set, or a complete array of configs.
-
mixed|null$value optional The value to set.
-
bool$merge optional Whether to recursively merge or overwrite existing config, defaults to true.
Returns
mixedThrows
Cake\Core\Exception\ExceptionWhen trying to set a key that is invalid.
configShallow() ¶ public
configShallow(string|array $key, mixed|null $value = null): $thisMerge provided config with existing config. Unlike config() which does
a recursive merge for nested keys, this method does a simple merge.
Setting a specific value:
$this->config('key', $value);Setting a nested value:
$this->config('some.nested.key', $value);Updating multiple config settings at the same time:
$this->config(['one' => 'value', 'another' => 'value']);Parameters
-
string|array$key The key to set, or a complete array of configs.
-
mixed|null$value optional The value to set.
Returns
$thisgenerateToken() ¶ public
generateToken(Cake\Network\Request $request): boolManually add form tampering prevention token information into the provided request object.
Parameters
-
Cake\Network\Request$request The request object to add into.
Returns
boolimplementedEvents() ¶ public
implementedEvents(): arrayEvents supported by this component.
Uses Conventions to map controller events to standard component callback method names. By defining one of the callback methods a component is assumed to be interested in the related event.
Override this method if you need to add non-conventional event listeners. Or if you want components to listen to non-standard events.
Returns
arrayinitialize() ¶ public
initialize(array $config): voidConstructor hook method.
Implement this method to avoid having to overwrite the constructor and call parent.
Parameters
-
array$config The configuration settings provided to this component.
Returns
voidlog() ¶ public
log(mixed $msg, int|string $level = LogLevel::ERROR, string|array $context = []): boolConvenience method to write a message to Log. See Log::write() for more information on writing to logs.
Parameters
-
mixed$msg Log message.
-
int|string$level optional Error level.
-
string|array$context optional Additional log data relevant to this message.
Returns
boolrequireAuth() ¶ public
requireAuth(string|array $actions): voidSets the actions that require whitelisted form submissions.
Adding actions with this method will enforce the restrictions set in SecurityComponent::$allowedControllers and SecurityComponent::$allowedActions.
Parameters
-
string|array$actions Actions list
Returns
voidrequireSecure() ¶ public
requireSecure(string|array $actions = null): voidSets the actions that require a request that is SSL-secured, or empty for all actions
Parameters
-
string|array$actions optional Actions list
Returns
voidstartup() ¶ public
startup(Event $event): mixedComponent startup. All security checking happens here.
Parameters
-
Event$event An Event instance
Returns
mixedProperty Detail
$_configInitialized ¶ protected
Whether the config property has already been configured with defaults
Type
bool$_defaultConfig ¶ protected
Default config
blackHoleCallback- The controller method that will be called if this request is black-hole'd.requireSecure- List of actions that require an SSL-secured connection.requireAuth- List of actions that require a valid authentication key.allowedControllers- Controllers from which actions of the current controller are allowed to receive requests.allowedActions- Actions from which actions of the current controller are allowed to receive requests.unlockedFields- Form fields to exclude from POST validation. Fields can be unlocked either in the Component, or with FormHelper::unlockField(). Fields that have been unlocked are not required to be part of the POST and hidden unlocked fields do not have their values checked.unlockedActions- Actions to exclude from POST validation checks. Other checks like requireAuth(), requireSecure() etc. will still be applied.validatePost- Whether to validate POST data. Set to false to disable for data coming from 3rd party services, etc.
Type
array$_registry ¶ protected
Component registry class used to lazy load components.
Type
Cake\Controller\ComponentRegistry