octobercms/october · error · Twig\Sandbox\SecurityNotAllowedMethodError

Calling "%s" method on a session is blocked in Safe Mode.

Error message

Calling "%s" method on a session is blocked in Safe Mode.

What it means

Error "Calling "%s" method on a session is blocked in Safe Mode." thrown in octobercms/october.

Source

Thrown at modules/system/twig/securitypolicy/SafeSessionStore.php:83

        'errors',             // Validation error bag
        'widget.',            // Backend SessionMaker widget state (consumed by unserialize)
    ];

    /**
     * __construct
     */
    public function __construct(Store $session)
    {
        $this->session = $session;
    }

    /**
     * __call magic
     */
    public function __call($method, $parameters)
    {
        if (!in_array($method, $this->allowedMethods, true)) {
            throw new SecurityNotAllowedMethodError(
                sprintf('Calling "%s" method on a session is blocked in Safe Mode.', $method),
                Store::class,
                $method
            );
        }

        if (in_array($method, $this->writeMethods, true)) {
            $this->assertKeyAllowed($method, $parameters[0] ?? null);
        }

        return $this->session->{$method}(...$parameters);
    }

    /**
     * assertKeyAllowed rejects writes to reserved session key prefixes.
     * Arrays (e.g. put(['k' => 'v'], ...)) and dot-notation keys are
     * normalized to their top-level segment before checking.
     */

View on GitHub (pinned to b608633a7e)

When it happens

Trigger: Thrown at modules/system/twig/securitypolicy/SafeSessionStore.php:83 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of octobercms/october@b608633a7e (2026-08-21). Data as JSON: /api/errors/d836cf0d2e78d669. Report an issue: GitHub.