Hardening Checklist

Check these points before you run a CakePHP 2 application in production. Each item links to the page of this book that describes the setting.

Disable Debug Mode

Set debug to 0 in production. With a higher debug level, error messages, stack traces and SQL queries are shown to visitors. Applications created from the pieceofcake2/app skeleton read the level from the DEBUG environment variable and use level 2 when it is not set, so set DEBUG=0 on the production server. See Update core.php.

Use Your Own Salt and Cipher Seed

Set Security.salt and Security.cipherSeed to secret values that are unique to your application, not the values shipped with the skeleton. The salt is used to sign CSRF tokens and form tampering tokens and is the default key of CookieComponent; CakePHP shows a notice while the skeleton's default salt is in use. The skeleton reads the values from the SECURITY_SALT and SECURITY_CIPHER_SEED environment variables. See Security.salt and Security.cipherSeed in Core Configuration and Environment Variables.

Changing the salt invalidates outstanding CSRF tokens and cookies encrypted with the default key.

Keep Dependencies Up to Date

Security fixes are released only for the latest release (see Supported Versions). Update pieceofcake2/cakephp, the plugins and the other packages regularly with Composer, and install them without development dependencies in production:

composer update
composer install --no-dev --optimize-autoloader

Keep composer/ca-bundle up to date as well; it provides the CA certificates for HTTPS connections made by HttpSocket. See Security Fixes and Install dependencies for production.

Use SecurityComponent for Forms and CSRF

Load SecurityComponent in controllers that handle forms. It checks forms for tampering, and its CSRF protection ($csrfCheck, enabled by default) validates a token on every request except GET, HEAD and OPTIONS. Do not disable the checks for whole controllers; unlock only the actions or fields that need it.

Also validate input with Data Validation, and do not build view, layout or element names or Xml::build() input from user input without checking it (see Security Fixes).

Secure Cookies and Sessions

• CakePHP sets session.cookie_httponly for the session cookie, and sets session.cookie_secure when the request is made over HTTPS, unless you set these ini values yourself. Other session ini settings, such as session.cookie_samesite, can be set in Session.ini. See Sessions.
• CookieComponent does not set the secure and httpOnly flags by default. Set $this->Cookie->secure = true; so that cookies are sent only over HTTPS, and $this->Cookie->httpOnly = true; for cookies that JavaScript does not need to read. See Cookie.
• Use the 'aes' cookie encryption type instead of the default 'cipher', and enable Security.useOpenSsl. See CookieComponent cipher type.

Restrict File Permissions

Set the document root to the webroot/ directory, so that the application code, the configuration and vendor/ cannot be accessed through a URL. The web server needs write access only to tmp/ and logs/. See Set document root, Permissions and URL Rewriting.

Use HTTPS

Serve the application over HTTPS only. The session cookie is marked secure when CakePHP detects HTTPS (the HTTPS server variable). Actions can require HTTPS with SecurityComponent::requireSecure(); see Restrict actions to SSL. Configure TLS and redirects in the web server; see URL Rewriting and Deployment.

Use a Supported PHP Version

pieceofcake2/cakephp runs on PHP 8.0 to 8.5 (see Requirements). Use a PHP version that still receives security fixes from the PHP project; see Supported Versions on php.net.