Application.php

public function middleware($middlewareQueue)
    {
        $securityHeaders = new SecurityHeadersMiddleware();
        $securityHeaders
            ->setCrossDomainPolicy()
            ->setReferrerPolicy()
            ->setXFrameOptions()
            ->setXssProtection()
            ->noOpen()
            ->noSniff();

        $csrf = new CsrfProtectionMiddleware([
                'httpOnly' => true
            ]);
        $csrf->whitelistCallback(function ($request) {
            if ($request->getParam('controller') === 'FaturaCreditos') {
                return true;
            }
            if($request->getParam('controller') === 'Users' && $request->getParam('action') === 'deleteUsersSelecionados'){
                return true;
            }
        });
        $middlewareQueue

            // Catch any exceptions in the lower layers,
            // and make an error page/response
            ->add(ErrorHandlerMiddleware::class)

            // Handle plugin/theme assets like CakePHP normally does.
            ->add(AssetMiddleware::class)

            // Add routing middleware.
            // Routes collection cache enabled by default, to disable route caching
            // pass null as cacheConfig, example: `new RoutingMiddleware($this)`
            // you might want to disable this cache in case your routing is extremely simple
            ->add(new RoutingMiddleware($this, '_cake_routes_'))
            ->add($csrf)
            // Add csrf middleware.
            // ->add(new CsrfProtectionMiddleware([
            //     'httpOnly' => true
            // ]))
            ->add($securityHeaders);

        return $middlewareQueue;
    }