yiisoft/yii2 · error · InvalidConfigException

{cipher} is not an allowed cipher

Error message

{cipher} is not an allowed cipher

What it means

encrypt() looks up $this->cipher in the allowedCiphers map and needs both elements of its [blockSize, keySize] entry; when the configured cipher is not a key there, isset() fails and InvalidConfigException is thrown. Defaults are the 'AES-128-CBC'/'AES-192-CBC'/'AES-256-CBC' family, so legacy lowercase values like 'aes-256', other OpenSSL names like 'aes-256-gcm', or pruning allowedCiphers while leaving cipher pointing at a removed name all trigger it.

Source

Thrown at framework/base/Security.php:205

     *
     * @param string $data data to be encrypted
     * @param bool $passwordBased set true to use password-based key derivation
     * @param string $secret the encryption password or key
     * @param string|null $info context/application specific information, e.g. a user ID
     * See [RFC 5869 Section 3.2](https://tools.ietf.org/html/rfc5869#section-3.2) for more details.
     *
     * @return string the encrypted data as byte string
     * @throws InvalidConfigException on OpenSSL not loaded
     * @throws Exception on OpenSSL error
     * @see decrypt()
     */
    protected function encrypt($data, $passwordBased, $secret, $info)
    {
        if (!extension_loaded('openssl')) {
            throw new InvalidConfigException('Encryption requires the OpenSSL PHP extension');
        }
        if (!isset($this->allowedCiphers[$this->cipher][0], $this->allowedCiphers[$this->cipher][1])) {
            throw new InvalidConfigException($this->cipher . ' is not an allowed cipher');
        }

        list($blockSize, $keySize) = $this->allowedCiphers[$this->cipher];

        $keySalt = $this->generateRandomKey($keySize);
        if ($passwordBased) {
            $key = $this->pbkdf2($this->kdfHash, $secret, $keySalt, $this->derivationIterations, $keySize);
        } else {
            $key = $this->hkdf($this->kdfHash, $secret, $keySalt, $info, $keySize);
        }

        $iv = $this->generateRandomKey($blockSize);

        $encrypted = openssl_encrypt($data, $this->cipher, $key, OPENSSL_RAW_DATA, $iv);
        if ($encrypted === false) {
            throw new \yii\base\Exception('OpenSSL failure on encryption: ' . openssl_error_string());
        }

View on GitHub (pinned to 66f00d18a2)

Solutions

1. Set cipher to one of the allowedCiphers keys of your installed version — read them from Yii::$app->security->allowedCiphers rather than hand-typing
2. If allowedCiphers was customized, make sure the value of cipher is present in that same customized map
3. Assert cipher membership once at bootstrap so misconfiguration fails loudly on deploy
4. Remember a cipher change does not decrypt existing data — migrate/re-encrypt before switching environments that share ciphertexts

Example fix

// before
'components' => [
    'security' => ['cipher' => 'aes-256'], // not an allowedCiphers key
],

// after
'components' => [
    'security' => ['cipher' => 'AES-256-CBC'],
],

$security = Yii::$app->security;
if (!isset($security->allowedCiphers[$security->cipher][0], $security->allowedCiphers[$security->cipher][1])) {
    throw new \RuntimeException('Security cipher misconfigured: ' . $security->cipher);
}

function isAllowedCipher(\yii\base\Security $s): bool
{
    return isset($s->allowedCiphers[$s->cipher][0], $s->allowedCiphers[$s->cipher][1]);
}

try {
    Yii::$app->security->encryptByKey($data, $key);
} catch (\yii\base\InvalidConfigException $e) {
    // cipher not in allowedCiphers — config bug, fail the deploy loudly
}

When it happens

Trigger: 'components' => ['security' => ['cipher' => 'aes-256']] (lowercase legacy value not in the map); restricting allowedCiphers to a policy subset that no longer contains the configured default; copying cipher settings between Yii versions whose allowedCiphers keys changed spelling.

Common situations: Security hardening that whitelists ciphers for compliance; config copied from old StackOverflow answers or docs; per-environment drift where one environment renames the cipher and encrypted data stops working there.

Related errors

• Encryption requires the OpenSSL PHP extension
• Failed to generate HMAC with hash algorithm: {macHash}
• Invalid validation rule: a rule must specify both attribute
• The directory does not exist: $path
• Invalid parameters to hash_hkdf()

AI-assisted analysis of yiisoft/yii2@66f00d18a2 (2026-08-17). Data as JSON: /api/errors/22d62093c8aa4dc3. Report an issue: GitHub.