Whitelisting instead of blacklisting with SecurityComponent::requireSecure()

Question

I'd like to use CakePHP's SecurityComponent to enforce app requests to be made over SSL using requireSecure().

My issue is that by default this is a blacklist methodology - allow insecure access by default, unless explicitly prohibited in that Controller. I'd like to switch to a whitelist methodology - deny insecure access by default, unless I explicitly allow it in that Controller.

Is this functionality built into the SecurityComponent? If not, how can I set this up manually?

I'm interested in forcing SSL in an app I'm building in CakePHP myself at the moment. But would it not be better to just redirect all http requests to https which in turn forces ssl to be used? This seems more subtle from a user perspective as well, as they just redirected, rather than getting a security error if they use the wrong protocol. — Cameron, Aug 17 '13 at 14:53
There's a man-in-the-middle attack the authors are trying to avoid, [Is redirecting http to https a bad idea](http://stackoverflow.com/questions/4365294/is-redirecting-http-to-https-a-bad-idea). Definitely a huge usability problem, black holing is an awful solution. Not an expert on this, but I'm that question has the best solutions. — Brad Koch, Aug 17 '13 at 20:32

score 0 · Accepted Answer · answered Oct 16 '12 at 18:11

It doesn't appear that this is built in by default. You could simulate this by creating a $requireSecure property of your Controllers, and then conditionally calling requireSecure() in AppController::beforeFilter(). Here's how you would implement it:

AppController.php:

public $requireSecure = true;

public function beforeFilter() {
    if ($this->requireSecure) {
        $blacklist = is_array($this->requireSecure) ? $this->requireSecure : array('*');
        $this->Security->requireSecure($blacklist);
    }
}

Whitelisted controller:

public $requireSecure = false;

Controller, varies by method (note that $requireSecure is a blacklist):

public $requireSecure = array('login');

This achieves the objective of requiring SSL by default, but being able to explicitly override this requirement in the Controller if desired.

Whitelisting instead of blacklisting with SecurityComponent::requireSecure()

1 Answers1