# [Usage](../../../usage.md) > Security

Use this page as the single entry point for framework security: the `security.php` config plus what each middleware does. All framework configs live in `config/k-framework` after `php artisan kfw:update`.

In short: form submissions are UUID-validated + MIME-checked + throttled, guest pages are throttled, the API is throttled + permission-checked, role routes are gated, and responses carry baseline security headers.

---

## Config (`config/k-framework/security.php`)

### `allow_only_kfw_forms`
When `true` (default), only forms generated by the framework (with a cached `kfw_form_uuid`) are accepted. Submissions without a UUID, with an unknown UUID, or with a UUID owned by another user are rejected by `KFrameworkFormValidation`.

### `api_throttle` / `guest_throttle` / `forms_throttle`
Brute-force protection in Laravel throttle format `"max,decay_minutes"`:
- `api_throttle` (`60,1`): integrated API endpoint.
- `guest_throttle` (`60,1`): framework guest pages (login / register / password reset).
- `forms_throttle` (`30,1`): requests carrying `kfw_form_uuid`.

### `api_excluded_tables`
Tables never exposed through the integrated API, for both raw SQL and structured operations. Defaults exclude `users`, `cache`, `cache_locks`, `sessions`, `password_reset_tokens`, `kfw_api_credentials`, `kfw_api_permissions`, `kfw_api_ips`. They disappear from the permission repeater options in the API credentials view.

### `allowed_mime_types`
Only these MIME types can be uploaded in forms, checked by `KFrameworkFormValidation`. Add `'*'` to allow any file type. Covers images, video, audio, documents and archives by default.

### Save-time escaping
Submitted form values are HTML-escaped before storage. Richtext `TextArea` fields and `Input` fields with `type` password are preserved verbatim.

---

## Middleware

Pushed to the `web` group by `KFrameworkServiceProvider` (in this order when enabled):

- **`RoleMiddleware`** (only when `config/k-framework/roles.php` `enabled` is `true`) — gates routes under `auth` middleware via `RolesHelper`. Skips `kfw.*`, `debugbar`, `generated::` and `excluded_routes`. The `root` role bypasses all checks. See [Roles resource](roles_resource.md).
- **`KFrameworkFormValidation`** — enforces the MIME allow-list on uploads and delegates `kfw_form_uuid` submissions to server-side validation (context match, ownership, rules). Lazy-schema loads (`load-schema`) bypass it by design.
- **`GuestThrottleMiddleware`** — throttles only routes behind `guest` / `RedirectIfAuthenticated` using `guest_throttle`.
- **`FormThrottleMiddleware`** — throttles only requests carrying `kfw_form_uuid` using `forms_throttle`. Other requests pass through.
- **`SecurityHeadersMiddleware`** — adds `X-Content-Type-Options: nosniff`, `X-Frame-Options: SAMEORIGIN`, `Referrer-Policy`, `Permissions-Policy` (no camera/mic/geolocation) and `Strict-Transport-Security` on HTTPS, without overwriting app-set values.

Registered on specific routes (not global):

- **`RedirectIfAuthenticated`** — on framework login / register / password pages. Unlike Laravel's `guest` middleware it redirects to `config/k-framework/guest.php` `login_redirects_to` (default `/`).

Available but opt-in (not pushed automatically, attach it in your HTTP kernel if wanted):

- **`HandleHttpErrors`** — converts 404 / 419 responses and exceptions into a `/` redirect instead of an error page. Other errors are re-thrown.

---

## Example

```php
// config/k-framework/security.php
'allow_only_kfw_forms' => true,
'guest_throttle' => '60,1',
'forms_throttle' => '30,1',
'allowed_mime_types' => ['image/jpeg', 'image/png', 'application/pdf'],
```

```php
// config/k-framework/roles.php — pair with the middleware above
'enabled' => true,
'excluded_routes' => ['billing.webhook'],
```

## See also

- [Usage](../../../usage.md)
- [Roles resource](roles_resource.md) / [RolesHelper](roles_helper.md) — `root`, permissions, `setAuthorize()`
- [API](api.md) — quotas, IP allow-list, excluded tables
- [Caching](caching.md) — signed cache, ownership checks behind validation
- [Installation](../../../installation.md) — `config/k-framework` publishing via `kfw:update`