 <p>When security is high, a new session ID get generated on every request. It is practically impossible to create a single-sign-on solution between two applications by sharing a session cookie in this case, since Cake will constantly change the session ID without notifying the other application.</p> <p>When security is medium (or higher), <a href="http://www.php.net/manual/en/session.configuration.php#ini.session.referer-check" rel="nofollow noreferrer">session.referer_check</a> is enabled.</p> <p>When security is low, you don't have either of the above features, but it is still just as secure as any average PHP website/CMS out there.</p>