$request
$request : \Cake\Http\ServerRequest
Request object
Provides CSRF protection & validation.
This component adds a CSRF token to a cookie. The cookie value is compared to request data, or the X-CSRF-Token header on each PATCH, POST, PUT, or DELETE request.
If the request data is missing or does not match the cookie data, an InvalidCsrfTokenException will be raised.
This component integrates with the FormHelper automatically and when
used together your forms will have CSRF tokens automatically added
when $this->Form->create(...) is used in a view.
$request : \Cake\Http\ServerRequest
Request object
$response : \Cake\Http\Response
Response object
$_registry : \Cake\Controller\ComponentRegistry
Component registry class used to lazy load components.
$_defaultConfig : array
Default config for the CSRF handling.
__construct(\Cake\Controller\ComponentRegistry $registry, array $config = array())
Constructor
| \Cake\Controller\ComponentRegistry | $registry | A ComponentRegistry this component can use to lazy load its components |
| array | $config | Array of configuration settings. |
getController() : \Cake\Controller\Controller
Get the controller this component is bound to.
The bound controller.
implementedEvents() : array
Events supported by this component.
Uses Conventions to map controller events to standard component callback method names. By defining one of the callback methods a component is assumed to be interested in the related event.
Override this method if you need to add non-conventional event listeners. Or if you want components to listen to non-standard events.
setConfig(string|array $key, mixed|null $value = null, boolean $merge = true) : $this
Sets the config.
Setting a specific value:
$this->setConfig('key', $value);Setting a nested value:
$this->setConfig('some.nested.key', $value);Updating multiple config settings at the same time:
$this->setConfig(['one' => 'value', 'another' => 'value']);| string|array | $key | The key to set, or a complete array of configs. |
| mixed|null | $value | The value to set. |
| boolean | $merge | Whether to recursively merge or overwrite existing config, defaults to true. |
When trying to set a key that is invalid.
getConfig(string|null $key = null, mixed $default = null) : mixed
Returns the config.
Reading the whole config:
$this->getConfig();Reading a specific value:
$this->getConfig('key');Reading a nested value:
$this->getConfig('some.nested.key');Reading with default value:
$this->getConfig('some-key', 'default-value');| string|null | $key | The key to get or null for the whole config. |
| mixed | $default | The return value when the key does not exist. |
Config value being read.
config(string|array|null $key = null, mixed|null $value = null, boolean $merge = true) : mixed
Gets/Sets the config.
Reading the whole config:
$this->config();Reading a specific value:
$this->config('key');Reading a nested value:
$this->config('some.nested.key');Setting a specific value:
$this->config('key', $value);Setting a nested value:
$this->config('some.nested.key', $value);Updating multiple config settings at the same time:
$this->config(['one' => 'value', 'another' => 'value']);| string|array|null | $key | The key to get/set, or a complete array of configs. |
| mixed|null | $value | The value to set. |
| boolean | $merge | Whether to recursively merge or overwrite existing config, defaults to true. |
When trying to set a key that is invalid.
Config value being read, or the object itself on write operations.
configShallow(string|array $key, mixed|null $value = null) : $this
Merge provided config with existing config. Unlike `config()` which does a recursive merge for nested keys, this method does a simple merge.
Setting a specific value:
$this->configShallow('key', $value);Setting a nested value:
$this->configShallow('some.nested.key', $value);Updating multiple config settings at the same time:
$this->configShallow(['one' => 'value', 'another' => 'value']);| string|array | $key | The key to set, or a complete array of configs. |
| mixed|null | $value | The value to set. |
log(mixed $msg, integer|string $level = \Psr\Log\LogLevel::ERROR, string|array $context = array()) : boolean
Convenience method to write a message to Log. See Log::write() for more information on writing to logs.
| mixed | $msg | Log message. |
| integer|string | $level | Error level. |
| string|array | $context | Additional log data relevant to this message. |
Success of log write.
startup(\Cake\Event\Event $event) : void
Startup callback.
Validates the CSRF token for POST data. If the request is a GET request, and the cookie value is absent a cookie will be set.
Once a cookie is set it will be copied into request->getParam('_csrfToken') so that application and framework code can easily access the csrf token.
RequestAction requests do not get checked, nor will they set a cookie should it be missing.
| \Cake\Event\Event | $event | Event instance. |
_configWrite(string|array $key, mixed $value, boolean|string $merge = false) : void
Writes a config key.
| string|array | $key | Key to write to. |
| mixed | $value | Value to write. |
| boolean|string | $merge | True to merge recursively, 'shallow' for simple merge, false to overwrite, defaults to false. |
if attempting to clobber existing config
_setCookie(\Cake\Http\ServerRequest $request, \Cake\Http\Response $response) : array
Set the cookie in the response.
Also sets the request->params['_csrfToken'] so the newly minted token is available in the request data.
| \Cake\Http\ServerRequest | $request | The request object. |
| \Cake\Http\Response | $response | The response object. |
An array of the modified request, response.
_validateToken(\Cake\Http\ServerRequest $request) : void
Validate the request data against the cookie token.
| \Cake\Http\ServerRequest | $request | The request to validate against. |
when the CSRF token is invalid or missing.