Fix Shadow API Exposure in Yii

namespace app\controllers;
use yii\rest\ActiveController;
/**

VULNERABLE: Exposes all CRUD operations by default.
Attackers can guess /users/delete/1 even if the UI doesn’t use it.
*/
class UserController extends ActiveController
{
public $modelClass = ‘app\models\User’;
}

namespace app\controllers;
use yii\rest\ActiveController;
use yii\filters\auth\HttpBearerAuth;
use yii\filters\AccessControl;
use yii\filters\VerbFilter;
class UserController extends ActiveController
{
public $modelClass = ‘app\models\User’;
public function actions()
{
    $actions = parent::actions();
    // Explicitly disable shadow endpoints not required by the business logic
    unset($actions['delete'], $actions['create'], $actions['update']);
    return $actions;
}

public function behaviors()
{
    $behaviors = parent::behaviors();
    
    // Enforce Authentication
    $behaviors['authenticator'] = [
        'class' => HttpBearerAuth::class,
    ];

    // Enforce RBAC/Access Control
    $behaviors['access'] = [
        'class' => AccessControl::class,
        'rules' => [
            [
                'allow' => true,
                'actions' => ['index', 'view'],
                'roles' => ['@'], // Only authenticated users
            ],
        ],
    ];

    // Hard-restrict HTTP Verbs
    $behaviors['verbs'] = [
        'class' => VerbFilter::class,
        'actions' => [
            'index' => ['GET'],
            'view' => ['GET'],
        ],
    ];

    return $behaviors;
}
}