Class SecurityComponent
The Security Component creates an easy way to integrate tighter security in your application. It provides methods for various tasks like:
- Restricting which HTTP methods your application accepts.
- Form tampering protection
- Requiring that SSL be used.
- Limiting cross controller communication.
Link: https://book.cakephp.org/3/en/controllers/components/security.html
Constants
-
stringDEFAULT_EXCEPTION_MESSAGE ¶'The request has been black-holed'Default message used for exceptions thrown
Property Summary
-
$_action protected
stringHolds the current action of the controller
-
$_componentMap protected
arrayA component lookup table used to lazy load component objects.
-
$_config protected
arrayRuntime config
-
$_configInitialized protected
boolWhether the config property has already been configured with defaults
-
$_defaultConfig protected
arrayDefault config
-
$_registry protected
Cake\Controller\ComponentRegistryComponent registry class used to lazy load components.
-
$components public
arrayOther Components this component uses.
-
$request public deprecated
Cake\Http\ServerRequestRequest object
-
$response public deprecated
Cake\Http\ResponseResponse object
-
$session public
Cake\Http\SessionThe Session object
Method Summary
-
__construct() public
Constructor
-
__debugInfo() public
Returns an array that can be used to describe the internal state of this object.
-
__get() public
Magic method for lazy loading $components.
-
_authRequired() protected deprecated
Check if authentication is required
-
_callback() protected
Calls a controller callback method
-
_configDelete() protected
Deletes a single config key.
-
_configRead() protected
Reads a config key.
-
_configWrite() protected
Writes a config key.
-
_debugCheckFields() protected
Iterates data array to check against expected
-
_debugExpectedFields() protected
Generate debug message for the expected fields
-
_debugPostTokenNotMatching() protected
Create a message for humans to understand why Security token is not matching
-
_fieldsList() protected
Return the fields list for the hash calculation
-
_hashParts() protected
Return hash parts for the Token generation
-
_matchExistingFields() protected
Generate array of messages for the existing fields in POST data, matching dataFields in $expectedFields will be unset
-
_requireMethod() protected
Sets the actions that require a $method HTTP request, or empty for all actions
-
_secureRequired() protected
Check if access requires secure connection
-
_sortedUnlocked() protected
Get the sorted unlocked string
-
_throwException() protected
Check debug status and throw an Exception based on the existing one
-
_unlocked() protected
Get the unlocked string
-
_validToken() protected
Check if token is valid
-
_validatePost() protected
Validate submitted form
-
blackHole() public
Black-hole an invalid request with a 400 error or custom callback. If SecurityComponent::$blackHoleCallback is specified, it will use this callback by executing the method indicated in $error
-
config() public deprecated
Gets/Sets the config.
-
configShallow() public
Merge provided config with existing config. Unlike
config()which does a recursive merge for nested keys, this method does a simple merge. -
generateToken() public
Manually add form tampering prevention token information into the provided request object.
-
getConfig() public
Returns the config.
-
getConfigOrFail() public
Returns the config for this specific key.
-
getController() public
Get the controller this component is bound to.
-
implementedEvents() public
Events supported by this component.
-
initialize() public
Constructor hook method.
-
log() public
Convenience method to write a message to Log. See Log::write() for more information on writing to logs.
-
requireAuth() public deprecated
Sets the actions that require whitelisted form submissions.
-
requireSecure() public
Sets the actions that require a request that is SSL-secured, or empty for all actions
-
setConfig() public
Sets the config.
-
startup() public
Component startup. All security checking happens here.
Method Detail
__construct() ¶ public
__construct(Cake\Controller\ComponentRegistry $registry, array $config = [])Constructor
Parameters
-
Cake\Controller\ComponentRegistry$registry A ComponentRegistry this component can use to lazy load its components
-
array$config optional Array of configuration settings.
__debugInfo() ¶ public
__debugInfo(): arrayReturns an array that can be used to describe the internal state of this object.
Returns
array__get() ¶ public
__get(string $name): Cake\Controller\Component|nullMagic method for lazy loading $components.
Parameters
-
string$name Name of component to get.
Returns
Cake\Controller\Component|null_authRequired() ¶ protected
_authRequired(Cake\Controller\Controller $controller): boolCheck if authentication is required
Parameters
-
Cake\Controller\Controller$controller Instantiating controller
Returns
bool_callback() ¶ protected
_callback(Cake\Controller\Controller $controller, string $method, array $params = []): mixedCalls a controller callback method
Parameters
-
Cake\Controller\Controller$controller Instantiating controller
-
string$method Method to execute
-
array$params optional Parameters to send to method
Returns
mixedThrows
Cake\Http\Exception\BadRequestExceptionWhen a the blackholeCallback is not callable.
_configDelete() ¶ protected
_configDelete(string $key): voidDeletes a single config key.
Parameters
-
string$key Key to delete.
Returns
voidThrows
Cake\Core\Exception\Exceptionif attempting to clobber existing config
_configRead() ¶ protected
_configRead(string|null $key): mixedReads a config key.
Parameters
-
string|null$key Key to read.
Returns
mixed_configWrite() ¶ protected
_configWrite(string|array $key, mixed $value, bool|string $merge = false): voidWrites a config key.
Parameters
-
string|array$key Key to write to.
-
mixed$value Value to write.
-
bool|string$merge optional True to merge recursively, 'shallow' for simple merge, false to overwrite, defaults to false.
Returns
voidThrows
Cake\Core\Exception\Exceptionif attempting to clobber existing config
_debugCheckFields() ¶ protected
_debugCheckFields(array $dataFields, array $expectedFields = [], string $intKeyMessage = '', string $stringKeyMessage = '', string $missingMessage = ''): arrayIterates data array to check against expected
Parameters
-
array$dataFields Fields array, containing the POST data fields
-
array$expectedFields optional Fields array, containing the expected fields we should have in POST
-
string$intKeyMessage optional Message string if unexpected found in data fields indexed by int (not protected)
-
string$stringKeyMessage optional Message string if tampered found in data fields indexed by string (protected)
-
string$missingMessage optional Message string if missing field
Returns
array_debugExpectedFields() ¶ protected
_debugExpectedFields(array $expectedFields = [], string $missingMessage = ''): string|nullGenerate debug message for the expected fields
Parameters
-
array$expectedFields optional Expected fields
-
string$missingMessage optional Message template
Returns
string|null_debugPostTokenNotMatching() ¶ protected
_debugPostTokenNotMatching(Cake\Controller\Controller $controller, array $hashParts): stringCreate a message for humans to understand why Security token is not matching
Parameters
-
Cake\Controller\Controller$controller Instantiating controller
-
array$hashParts Elements used to generate the Token hash
Returns
string_fieldsList() ¶ protected
_fieldsList(array $check): arrayReturn the fields list for the hash calculation
Parameters
-
array$check Data array
Returns
array_hashParts() ¶ protected
_hashParts(Cake\Controller\Controller $controller): arrayReturn hash parts for the Token generation
Parameters
-
Cake\Controller\Controller$controller Instantiating controller
Returns
array_matchExistingFields() ¶ protected
_matchExistingFields(array $dataFields, array $expectedFields, string $intKeyMessage, string $stringKeyMessage): arrayGenerate array of messages for the existing fields in POST data, matching dataFields in $expectedFields will be unset
Parameters
-
array$dataFields Fields array, containing the POST data fields
-
array$expectedFields Fields array, containing the expected fields we should have in POST
-
string$intKeyMessage Message string if unexpected found in data fields indexed by int (not protected)
-
string$stringKeyMessage Message string if tampered found in data fields indexed by string (protected)
Returns
array_requireMethod() ¶ protected
_requireMethod(string $method, array $actions = []): voidSets the actions that require a $method HTTP request, or empty for all actions
Parameters
-
string$method The HTTP method to assign controller actions to
-
array$actions optional Controller actions to set the required HTTP method to.
Returns
void_secureRequired() ¶ protected
_secureRequired(Cake\Controller\Controller $controller): boolCheck if access requires secure connection
Parameters
-
Cake\Controller\Controller$controller Instantiating controller
Returns
bool_sortedUnlocked() ¶ protected
_sortedUnlocked(array $data): stringGet the sorted unlocked string
Parameters
-
array$data Data array
Returns
string_throwException() ¶ protected
_throwException(Cake\Controller\Exception\SecurityException|null $exception = null): voidCheck debug status and throw an Exception based on the existing one
Parameters
-
Cake\Controller\Exception\SecurityException|null$exception optional Additional debug info describing the cause
Returns
voidThrows
Cake\Http\Exception\BadRequestException_unlocked() ¶ protected
_unlocked(array $data): stringGet the unlocked string
Parameters
-
array$data Data array
Returns
string_validToken() ¶ protected
_validToken(Cake\Controller\Controller $controller): stringCheck if token is valid
Parameters
-
Cake\Controller\Controller$controller Instantiating controller
Returns
stringThrows
Cake\Controller\Exception\SecurityException_validatePost() ¶ protected
_validatePost(Cake\Controller\Controller $controller): boolValidate submitted form
Parameters
-
Cake\Controller\Controller$controller Instantiating controller
Returns
boolThrows
Cake\Controller\Exception\AuthSecurityExceptionblackHole() ¶ public
blackHole(Cake\Controller\Controller $controller, string $error = '', Cake\Controller\Exception\SecurityException|null $exception = null): mixedBlack-hole an invalid request with a 400 error or custom callback. If SecurityComponent::$blackHoleCallback is specified, it will use this callback by executing the method indicated in $error
Parameters
-
Cake\Controller\Controller$controller Instantiating controller
-
string$error optional Error method
-
Cake\Controller\Exception\SecurityException|null$exception optional Additional debug info describing the cause
Returns
mixedThrows
Cake\Http\Exception\BadRequestExceptionSee Also
Links
config() ¶ public
config(string|array|null $key = null, mixed|null $value = null, bool $merge = true): mixedGets/Sets the config.
Usage
Reading the whole config:
$this->config();Reading a specific value:
$this->config('key');Reading a nested value:
$this->config('some.nested.key');Setting a specific value:
$this->config('key', $value);Setting a nested value:
$this->config('some.nested.key', $value);Updating multiple config settings at the same time:
$this->config(['one' => 'value', 'another' => 'value']);Parameters
-
string|array|null$key optional The key to get/set, or a complete array of configs.
-
mixed|null$value optional The value to set.
-
bool$merge optional Whether to recursively merge or overwrite existing config, defaults to true.
Returns
mixedThrows
Cake\Core\Exception\ExceptionWhen trying to set a key that is invalid.
configShallow() ¶ public
configShallow(string|array $key, mixed|null $value = null): $thisMerge provided config with existing config. Unlike config() which does
a recursive merge for nested keys, this method does a simple merge.
Setting a specific value:
$this->configShallow('key', $value);Setting a nested value:
$this->configShallow('some.nested.key', $value);Updating multiple config settings at the same time:
$this->configShallow(['one' => 'value', 'another' => 'value']);Parameters
-
string|array$key The key to set, or a complete array of configs.
-
mixed|null$value optional The value to set.
Returns
$thisgenerateToken() ¶ public
generateToken(Cake\Http\ServerRequest $request): Cake\Http\ServerRequestManually add form tampering prevention token information into the provided request object.
Parameters
-
Cake\Http\ServerRequest$request The request object to add into.
Returns
Cake\Http\ServerRequestgetConfig() ¶ public
getConfig(string|null $key = null, mixed|null $default = null): mixed|nullReturns the config.
Usage
Reading the whole config:
$this->getConfig();Reading a specific value:
$this->getConfig('key');Reading a nested value:
$this->getConfig('some.nested.key');Reading with default value:
$this->getConfig('some-key', 'default-value');Parameters
-
string|null$key optional The key to get or null for the whole config.
-
mixed|null$default optional The return value when the key does not exist.
Returns
mixed|nullgetConfigOrFail() ¶ public
getConfigOrFail(string|null $key): mixedReturns the config for this specific key.
The config value for this key must exist, it can never be null.
Parameters
-
string|null$key The key to get.
Returns
mixedThrows
InvalidArgumentExceptiongetController() ¶ public
getController(): Cake\Controller\ControllerGet the controller this component is bound to.
Returns
Cake\Controller\ControllerimplementedEvents() ¶ public
implementedEvents(): arrayEvents supported by this component.
Uses Conventions to map controller events to standard component callback method names. By defining one of the callback methods a component is assumed to be interested in the related event.
Override this method if you need to add non-conventional event listeners. Or if you want components to listen to non-standard events.
Returns
arrayinitialize() ¶ public
initialize(array $config): voidConstructor hook method.
Implement this method to avoid having to overwrite the constructor and call parent.
Parameters
-
array$config The configuration settings provided to this component.
Returns
voidlog() ¶ public
log(mixed $message, int|string $level = LogLevel::ERROR, string|array $context = []): boolConvenience method to write a message to Log. See Log::write() for more information on writing to logs.
Parameters
-
mixed$message Log message.
-
int|string$level optional Error level.
-
string|array$context optional Additional log data relevant to this message.
Returns
boolrequireAuth() ¶ public
requireAuth(string|array $actions): voidSets the actions that require whitelisted form submissions.
Adding actions with this method will enforce the restrictions set in SecurityComponent::$allowedControllers and SecurityComponent::$allowedActions.
Parameters
-
string|array$actions Actions list
Returns
voidrequireSecure() ¶ public
requireSecure(string|array|null $actions = null): voidSets the actions that require a request that is SSL-secured, or empty for all actions
Parameters
-
string|array|null$actions optional Actions list
Returns
voidsetConfig() ¶ public
setConfig(string|array $key, mixed|null $value = null, bool $merge = true): $thisSets the config.
Usage
Setting a specific value:
$this->setConfig('key', $value);Setting a nested value:
$this->setConfig('some.nested.key', $value);Updating multiple config settings at the same time:
$this->setConfig(['one' => 'value', 'another' => 'value']);Parameters
-
string|array$key The key to set, or a complete array of configs.
-
mixed|null$value optional The value to set.
-
bool$merge optional Whether to recursively merge or overwrite existing config, defaults to true.
Returns
$thisThrows
Cake\Core\Exception\ExceptionWhen trying to set a key that is invalid.
startup() ¶ public
startup(Cake\Event\Event $event): mixedComponent startup. All security checking happens here.
Parameters
-
Cake\Event\Event$event An Event instance
Returns
mixedProperty Detail
$_configInitialized ¶ protected
Whether the config property has already been configured with defaults
Type
bool$_defaultConfig ¶ protected
Default config
blackHoleCallback- The controller method that will be called if this request is black-hole'd.requireSecure- List of actions that require an SSL-secured connection.requireAuth- List of actions that require a valid authentication key. Deprecated as of 3.2.2allowedControllers- Controllers from which actions of the current controller are allowed to receive requests.allowedActions- Actions from which actions of the current controller are allowed to receive requests.unlockedFields- Form fields to exclude from POST validation. Fields can be unlocked either in the Component, or with FormHelper::unlockField(). Fields that have been unlocked are not required to be part of the POST and hidden unlocked fields do not have their values checked.unlockedActions- Actions to exclude from POST validation checks. Other checks like requireAuth(), requireSecure() etc. will still be applied.validatePost- Whether to validate POST data. Set to false to disable for data coming from 3rd party services, etc.
Type
array$_registry ¶ protected
Component registry class used to lazy load components.
Type
Cake\Controller\ComponentRegistry