CoolCMS API

SecurityConfig
in package

FinalYes

Master switches of the Api layer security protections, with values from `config/Shared/security.neon` (`parameters.security.*`).

Each flag disables only its own protection, independently of the others. The JWT guard is controlled separately by jwt.guardMode (log|enforce), see JwtGuardConfig.

  • corsEnabled false: CorsTrait::applyCors() is a no-op (no CORS headers, preflight is not short-circuited). For environments without browser cross-origin calls.
  • rateLimitEnabled false: AuthPresenter skips the rate-limit check and hit on /auth/login and /auth/refresh.
  • auditLogEnabled false: AuthLogManager::log() is a no-op (nothing is written to cms_system_auth_log).
  • reCaptchaEnabled false: forms get an empty field instead of reCAPTCHA (ReCaptchaToggleExtension) and templates do not load the Google script.

Table of Contents

Properties

$auditLogEnabled  : bool
$corsEnabled  : bool
$rateLimitEnabled  : bool
$reCaptchaEnabled  : bool

Methods

__construct()  : mixed

Properties

$rateLimitEnabled read-only

public bool $rateLimitEnabled = true

$reCaptchaEnabled read-only

public bool $reCaptchaEnabled = true

Methods

__construct()

public __construct([bool $corsEnabled = true ][, bool $rateLimitEnabled = true ][, bool $auditLogEnabled = true ][, bool $reCaptchaEnabled = true ]) : mixed
Parameters
$corsEnabled : bool = true
$rateLimitEnabled : bool = true
$auditLogEnabled : bool = true
$reCaptchaEnabled : bool = true
On this page

Search results