What are the implications of using 'low' security in cakephp?

Question

I had an authentication problem in cakephp, when positing credentials from an external site the authentication would work, and then get immediately lost, with the site prompting for login information again.

This guy determined that the cakephp session cookie was changing. His solution was to set security to low.

Seems like in medium or high security Cake makes a double check for referer... but with low security works fine when clicking auth- protected links from external sites like hotmail or yahoo

This solution also worked for me, but what I am losing by setting cakephp to 'low' security?

Answer 1

When security is high, a new session ID get generated on every request. It is practically impossible to create a single-sign-on solution between two applications by sharing a session cookie in this case, since Cake will constantly change the session ID without notifying the other application.

When security is medium (or higher), session.referer_check is enabled.

When security is low, you don't have either of the above features, but it is still just as secure as any average PHP website/CMS out there.