{"record":{"id":"22d62093c8aa4dc3","repo":"yiisoft/yii2","slug":"cipher-is-not-an-allowed-cipher","errorCode":null,"errorMessage":"{cipher} is not an allowed cipher","messagePattern":"(.+?) is not an allowed cipher","errorType":"exception","errorClass":"InvalidConfigException","httpStatus":null,"severity":"error","filePath":"framework/base/Security.php","lineNumber":205,"sourceCode":"     *\n     * @param string $data data to be encrypted\n     * @param bool $passwordBased set true to use password-based key derivation\n     * @param string $secret the encryption password or key\n     * @param string|null $info context/application specific information, e.g. a user ID\n     * See [RFC 5869 Section 3.2](https://tools.ietf.org/html/rfc5869#section-3.2) for more details.\n     *\n     * @return string the encrypted data as byte string\n     * @throws InvalidConfigException on OpenSSL not loaded\n     * @throws Exception on OpenSSL error\n     * @see decrypt()\n     */\n    protected function encrypt($data, $passwordBased, $secret, $info)\n    {\n        if (!extension_loaded('openssl')) {\n            throw new InvalidConfigException('Encryption requires the OpenSSL PHP extension');\n        }\n        if (!isset($this->allowedCiphers[$this->cipher][0], $this->allowedCiphers[$this->cipher][1])) {\n            throw new InvalidConfigException($this->cipher . ' is not an allowed cipher');\n        }\n\n        list($blockSize, $keySize) = $this->allowedCiphers[$this->cipher];\n\n        $keySalt = $this->generateRandomKey($keySize);\n        if ($passwordBased) {\n            $key = $this->pbkdf2($this->kdfHash, $secret, $keySalt, $this->derivationIterations, $keySize);\n        } else {\n            $key = $this->hkdf($this->kdfHash, $secret, $keySalt, $info, $keySize);\n        }\n\n        $iv = $this->generateRandomKey($blockSize);\n\n        $encrypted = openssl_encrypt($data, $this->cipher, $key, OPENSSL_RAW_DATA, $iv);\n        if ($encrypted === false) {\n            throw new \\yii\\base\\Exception('OpenSSL failure on encryption: ' . openssl_error_string());\n        }\n","sourceCodeStart":187,"sourceCodeEnd":223,"githubUrl":"https://github.com/yiisoft/yii2/blob/66f00d18a29b520f85e8e8f1e32d1e7e7b556cac/framework/base/Security.php#L187-L223","documentation":"encrypt() looks up $this->cipher in the allowedCiphers map and needs both elements of its [blockSize, keySize] entry; when the configured cipher is not a key there, isset() fails and InvalidConfigException is thrown. Defaults are the 'AES-128-CBC'/'AES-192-CBC'/'AES-256-CBC' family, so legacy lowercase values like 'aes-256', other OpenSSL names like 'aes-256-gcm', or pruning allowedCiphers while leaving cipher pointing at a removed name all trigger it.","triggerScenarios":"'components' => ['security' => ['cipher' => 'aes-256']] (lowercase legacy value not in the map); restricting allowedCiphers to a policy subset that no longer contains the configured default; copying cipher settings between Yii versions whose allowedCiphers keys changed spelling.","commonSituations":"Security hardening that whitelists ciphers for compliance; config copied from old StackOverflow answers or docs; per-environment drift where one environment renames the cipher and encrypted data stops working there.","solutions":["Set cipher to one of the allowedCiphers keys of your installed version — read them from Yii::$app->security->allowedCiphers rather than hand-typing","If allowedCiphers was customized, make sure the value of cipher is present in that same customized map","Assert cipher membership once at bootstrap so misconfiguration fails loudly on deploy","Remember a cipher change does not decrypt existing data — migrate/re-encrypt before switching environments that share ciphertexts"],"exampleFix":"// before\n'components' => [\n    'security' => ['cipher' => 'aes-256'], // not an allowedCiphers key\n],\n\n// after\n'components' => [\n    'security' => ['cipher' => 'AES-256-CBC'],\n],","handlingStrategy":"validation","validationCode":"$security = Yii::$app->security;\nif (!isset($security->allowedCiphers[$security->cipher][0], $security->allowedCiphers[$security->cipher][1])) {\n    throw new \\RuntimeException('Security cipher misconfigured: ' . $security->cipher);\n}","typeGuard":"function isAllowedCipher(\\yii\\base\\Security $s): bool\n{\n    return isset($s->allowedCiphers[$s->cipher][0], $s->allowedCiphers[$s->cipher][1]);\n}","tryCatchPattern":"try {\n    Yii::$app->security->encryptByKey($data, $key);\n} catch (\\yii\\base\\InvalidConfigException $e) {\n    // cipher not in allowedCiphers — config bug, fail the deploy loudly\n}","preventionTips":["Copy cipher names from the allowedCiphers keys of the deployed version instead of hand-typing them","Assert cipher membership once at bootstrap in every environment","Keep the cipher identical in all environments that share encrypted data, and plan re-encryption before switching"],"tags":["php","yii2","security","encryption","cipher","config"],"backgroundTag":"unsupported-encryption-algorithm","analyzedSha":"66f00d18a29b520f85e8e8f1e32d1e7e7b556cac","analyzedAt":"2026-08-17T05:17:23.470Z","schemaVersion":2},"datasetVersion":"2026-08-17T09:17:11.063Z"}