CakePHP 5.4

Apply the PHP 8.5 baseline first. These rules cover CakePHP 5.4 on PHP 8.5; the line requires PHP 8.2 or later. Apply the authentication and authorization plugin rules when those plugins are installed.

Requests, routing, and proxy trust

• Wrap downstream request processing with ErrorHandlerMiddleware. Run RoutingMiddleware before checks that use route parameters, and BodyParserMiddleware before authentication or CSRF checks that consume parsed bodies. Review middleware coverage for plugin, prefix, fallback, and API routes.
• Restrict routes to their intended verbs and call $request->allowMethod() in mutation actions. Keep GET and HEAD free of mutations. Account for _method and X-Http-Method-Override; inspect ORIGINAL_REQUEST_METHOD or reject overrides where the endpoint requires the original transport verb.
• Enforce accepted media types and body-size limits before parsing. BodyParserMiddleware enables JSON and disables XML by default; its JSON decoder casts valid scalar and null values to arrays. Use addParser() with strict decoding and explicit top-level shape checks when the contract requires an object or list; do not treat successful parsing as validation.
• Give #[RequestToDto] an explicit RequestToDtoSource::Body or ::Query where only one source is allowed. Auto can fall back to query parameters when a mutation body is empty, and Request merges query and body data. Validate fields and invariants in the DTO's createFromArray() path before business use.
• Enable ServerRequest::$trustProxy or call setTrustedProxies() only behind an