I encountered this issue in one of my recent projects.

Basically I use SWFUpload to post files to a CakePHP controller. It was working beautifully, until I inadvertently removed 1 (yes, just one) line of code in beforeFilter():

$this->Auth->allow("swfupload");

I was using the Auth component, and without the line above to allow “not logged in” access to the controller action, then we have a problem.

Hope this helps somebody.