Request

API reference › Inertia › web › Request

class	`yii\inertia\web\Request`
Extends	`yii\web\Request` » `yii\base\Request` » `yii\base\Component` » `yii\base\BaseObject`
Implements	`yii\base\Configurable`
Source	`src/web/Request.php`

Configures CSRF protection for Inertia applications using the cookie-to-header pattern.

Properties

Property	Type	Description	Defined by
`$absoluteUrl` read-only	`string`	The currently requested absolute URL.	`yii\web\Request`
`$acceptableContentTypes`	`array`	The content types ordered by the quality score.	`yii\web\Request`
`$acceptableLanguages`	`array`	The languages ordered by the preference level.	`yii\web\Request`
`$authCredentials` read-only	`array`	That contains exactly two elements: - 0: the username sent via HTTP authentication, `null` if the username is not given - 1: the password sent via HTTP authentication, `null` if the password is not given.	`yii\web\Request`
`$authPassword` read-only	`string\|null`	The password sent via HTTP authentication, `null` if the password is not given.	`yii\web\Request`
`$authUser` read-only	`string\|null`	The username sent via HTTP authentication, `null` if the username is not given.	`yii\web\Request`
`$baseUrl`	`string`	The relative URL for the application.	`yii\web\Request`
`$behaviors` read-only	`array<yii\base\Behavior<static>>`	List of behaviors attached to this component.	`yii\base\Component`
`$bodyParams`	`mixed`	The request parameters given in the request body.	`yii\web\Request`
`$contentType` read-only	`string`	Request content-type.	`yii\web\Request`
`$cookies` read-only	`yii\web\CookieCollection`	The cookie collection.	`yii\web\Request`
`$cookieValidationKey`	`string`	A secret key used for cookie validation. Default: `null`.	`yii\web\Request`
`$csrfCookie`	`mixed[]`	Cookie options. `httpOnly` is `false` so JavaScript can read the CSRF token. Default: `['httpOnly' => false]`.	`Request`
`$csrfHeader`		Header checked for the CSRF token sent by Inertia’s HTTP client. Default: `'X-XSRF-TOKEN'`.	`Request`
`$csrfHeaderUnsafeMethods`	`array`	“unsafe” methods not triggered a CORS-preflight request This property is used only when both `$enableCsrfValidation` and `$validateCsrfHeaderOnly` are true. Default: `['GET', 'HEAD', 'POST']`.	`yii\web\Request`
`$csrfParam`		Cookie name and form parameter name for the CSRF token. Default: `'XSRF-TOKEN'`.	`Request`
`$csrfToken` read-only	`null\|string`	The token used to perform CSRF validation.	`yii\web\Request`
`$csrfTokenFromHeader` read-only	`string\|null`	The CSRF token sent via `$csrfHeader` by browser.	`yii\web\Request`
`$csrfTokenSafeMethods`	`array`	The name of the HTTP header for sending CSRF token. by default validate CSRF token on non-”safe” methods only This property is used only when `$enableCsrfValidation` is true. Default: `['GET', 'HEAD', 'OPTIONS']`.	`yii\web\Request`
`$enableCookieValidation`	`bool`	Whether cookies should be validated to ensure they are not tampered. Default: `true`.	`yii\web\Request`
`$enableCsrfCookie`	`bool`	Whether to use cookie to persist CSRF token. Default: `true`.	`yii\web\Request`
`$enableCsrfValidation`	`bool`	Whether to enable CSRF (Cross-Site Request Forgery) validation. Default: `true`.	`yii\web\Request`
`$eTags` read-only	`array`	The entity tags.	`yii\web\Request`
`$headers` read-only	`yii\web\HeaderCollection`	The header collection.	`yii\web\Request`
`$hostInfo`	`string\|null`	Schema and hostname part (with port number if needed) of the request URL (e.g. `https://www.yiiframework.com`), null if can’t be obtained from `$_SERVER` and wasn’t set.	`yii\web\Request`
`$hostName` read-only	`string\|null`	Hostname part of the request URL (e.g. `www.yiiframework.com`).	`yii\web\Request`
`$ipHeaders`	`string[]`	List of headers where proxies store the real client IP. Default: `['X-Forwarded-For']`. Available since 2.0.13.	`yii\web\Request`
`$isAjax` read-only	`bool`	Whether this is an AJAX (XMLHttpRequest) request.	`yii\web\Request`
`$isConsoleRequest`	`bool`	The value indicating whether the current request is made via console.	`yii\base\Request`
`$isDelete` read-only	`bool`	Whether this is a DELETE request.	`yii\web\Request`
`$isFlash` read-only	`bool`	Whether this is an Adobe Flash or Adobe Flex request.	`yii\web\Request`
`$isGet` read-only	`bool`	Whether this is a GET request.	`yii\web\Request`
`$isHead` read-only	`bool`	Whether this is a HEAD request.	`yii\web\Request`
`$isOptions` read-only	`bool`	Whether this is a OPTIONS request.	`yii\web\Request`
`$isPatch` read-only	`bool`	Whether this is a PATCH request.	`yii\web\Request`
`$isPjax` read-only	`bool`	Whether this is a PJAX request.	`yii\web\Request`
`$isPost` read-only	`bool`	Whether this is a POST request.	`yii\web\Request`
`$isPut` read-only	`bool`	Whether this is a PUT request.	`yii\web\Request`
`$isSecureConnection` read-only	`bool`	If the request is sent via secure channel (https).	`yii\web\Request`
`$method` read-only	`string`	Request method, such as GET, POST, HEAD, PUT, PATCH, DELETE.	`yii\web\Request`
`$methodParam`	`string`	The name of the POST parameter that is used to indicate if a request is a PUT, PATCH or DELETE request tunneled through POST. Default: `'_method'`.	`yii\web\Request`
`$origin` read-only	`string\|null`	URL origin of a CORS request, `null` if not available.	`yii\web\Request`
`$parsers`	`array`	The parsers for converting the raw HTTP request body into `$bodyParams`. Default: `[]`.	`yii\web\Request`
`$pathInfo`	`string`	Part of the request URL that is after the entry script and before the question mark.	`yii\web\Request`
`$port`	`int`	Port number for insecure requests.	`yii\web\Request`
`$portHeaders`	`string[]`	List of headers where proxies store the real request port. Default: `['X-Forwarded-Port']`. Available since 2.0.46.	`yii\web\Request`
`$preferredLanguage` read-only	`string`	The language that the application should use.	`yii\web\Request`
`$queryParams`	`array`	The request GET parameter values.	`yii\web\Request`
`$queryString` read-only	`string`	Part of the request URL that is after the question mark.	`yii\web\Request`
`$rawBody`	`string`	The request body.	`yii\web\Request`
`$referrer` read-only	`string\|null`	URL referrer, null if not available.	`yii\web\Request`
`$remoteHost` read-only	`string\|null`	Remote host name, `null` if not available.	`yii\web\Request`
`$remoteIP` read-only	`string\|null`	Remote IP address, `null` if not available.	`yii\web\Request`
`$scriptFile`	`string`	The entry script file path.	`yii\web\Request`
`$scriptUrl`	`string`	The relative URL of the entry script.	`yii\web\Request`
`$secureHeaders`	`array`	Lists of headers that are, by default, subject to the trusted host configuration. Default: `['X-Forwarded-For', 'X-Forwarded-Host', 'X-Forwarded-Proto', 'X-Forwarded-Port', 'Front-End-Https', 'X-Rewrite-Url', 'X-Original-Host']`. Available since 2.0.13.	`yii\web\Request`
`$securePort`	`int`	Port number for secure requests.	`yii\web\Request`
`$secureProtocolHeaders`	`array`	List of headers to check for determining whether the connection is made via HTTPS. Default: `['X-Forwarded-Proto' => ['https'], 'Front-End-Https' => ['on']]`. Available since 2.0.13.	`yii\web\Request`
`$serverName` read-only	`string\|null`	Server name, null if not available.	`yii\web\Request`
`$serverPort` read-only	`int\|null`	Server port number, null if not available.	`yii\web\Request`
`$trustedHosts`	`array`	The configuration for trusted security related headers. Default: `[]`. Available since 2.0.13.	`yii\web\Request`
`$url`	`string`	The currently requested relative URL.	`yii\web\Request`
`$userAgent` read-only	`string\|null`	User agent, null if not available.	`yii\web\Request`
`$userHost` read-only	`string\|null`	User host name, null if not available.	`yii\web\Request`
`$userIP` read-only	`string\|null`	User IP address, null if not available.	`yii\web\Request`
`$validateCsrfHeaderOnly`	`bool`	Whether to use custom header only to CSRF validation of SPA. Default: `false`.	`yii\web\Request`

Methods

Method	Description	Defined by
`__construct()`	Constructor.	`yii\base\BaseObject`
`__call()`	Calls the named method which is not a class method.	`yii\base\Component`
`__clone()`	This method is called after the object is created by cloning an existing one.	`yii\base\Component`
`__get()`	Returns the value of a component property.	`yii\base\Component`
`__isset()`	Checks if a property is set, i.e. defined and not null.	`yii\base\Component`
`__set()`	Sets the value of a component property.	`yii\base\Component`
`__unset()`	Sets a component property to be null.	`yii\base\Component`
`attachBehavior()`	Attaches a behavior to this component.	`yii\base\Component`
`attachBehaviors()`	Attaches a list of behaviors to the component.	`yii\base\Component`
`behaviors()`	Returns a list of behaviors that this component should behave as.	`yii\base\Component`
`canGetProperty()`	Returns a value indicating whether a property can be read.	`yii\base\Component`
`canSetProperty()`	Returns a value indicating whether a property can be set.	`yii\base\Component`
`className()` static	Returns the fully qualified name of this class.	`yii\base\BaseObject`
`detachBehavior()`	Detaches a behavior from the component.	`yii\base\Component`
`detachBehaviors()`	Detaches all behaviors from the component.	`yii\base\Component`
`ensureBehaviors()`	Makes sure that the behaviors declared in `behaviors()` are attached to this component.	`yii\base\Component`
`get()`	Returns GET parameter with a given name. If name isn’t specified, returns an array of all GET parameters.	`yii\web\Request`
`getAbsoluteUrl()`	Returns the currently requested absolute URL.	`yii\web\Request`
`getAcceptableContentTypes()`	Returns the content types acceptable by the end user.	`yii\web\Request`
`getAcceptableLanguages()`	Returns the languages acceptable by the end user.	`yii\web\Request`
`getAuthCredentials()`		`yii\web\Request`
`getAuthPassword()`		`yii\web\Request`
`getAuthUser()`		`yii\web\Request`
`getBaseUrl()`	Returns the relative URL for the application.	`yii\web\Request`
`getBehavior()`	Returns the named behavior object.	`yii\base\Component`
`getBehaviors()`	Returns all behaviors attached to this component.	`yii\base\Component`
`getBodyParam()`	Returns the named request body parameter value.	`yii\web\Request`
`getBodyParams()`	Returns the request parameters given in the request body.	`yii\web\Request`
`getContentType()`	Returns request content-type The Content-Type header field indicates the MIME type of the data contained in `getRawBody()` or, in the case of the HEAD method, the media type that would have been sent had the request been a GET.	`yii\web\Request`
`getCookies()`	Returns the cookie collection.	`yii\web\Request`
`getCsrfToken()`	Returns the token used to perform CSRF validation.	`yii\web\Request`
`getCsrfTokenFromHeader()`	Returns the CSRF token sent via the `X-XSRF-TOKEN` header.	`Request`
`getETags()`	Gets the Etags.	`yii\web\Request`
`getHeaders()`	Returns the header collection.	`yii\web\Request`
`getHostInfo()`	Returns the schema and host part of the current request URL.	`yii\web\Request`
`getHostName()`	Returns the host part of the current request URL.	`yii\web\Request`
`getIsAjax()`	Returns whether this is an AJAX (XMLHttpRequest) request.	`yii\web\Request`
`getIsConsoleRequest()`	Returns a value indicating whether the current request is made via command line.	`yii\base\Request`
`getIsDelete()`	Returns whether this is a DELETE request.	`yii\web\Request`
`getIsFlash()`	Returns whether this is an Adobe Flash or Flex request.	`yii\web\Request`
`getIsGet()`	Returns whether this is a GET request.	`yii\web\Request`
`getIsHead()`	Returns whether this is a HEAD request.	`yii\web\Request`
`getIsOptions()`	Returns whether this is an OPTIONS request.	`yii\web\Request`
`getIsPatch()`	Returns whether this is a PATCH request.	`yii\web\Request`
`getIsPjax()`	Returns whether this is a PJAX request.	`yii\web\Request`
`getIsPost()`	Returns whether this is a POST request.	`yii\web\Request`
`getIsPut()`	Returns whether this is a PUT request.	`yii\web\Request`
`getIsSecureConnection()`	Return if the request is sent via secure channel (https).	`yii\web\Request`
`getMethod()`	Returns the method of the current request (e.g. GET, POST, HEAD, PUT, PATCH, DELETE).	`yii\web\Request`
`getOrigin()`	Returns the URL origin of a CORS request.	`yii\web\Request`
`getPathInfo()`	Returns the path info of the currently requested URL.	`yii\web\Request`
`getPort()`	Returns the port to use for insecure requests.	`yii\web\Request`
`getPreferredLanguage()`	Returns the user-preferred language that should be used by this application.	`yii\web\Request`
`getQueryParam()`	Returns the named GET parameter value.	`yii\web\Request`
`getQueryParams()`	Returns the request parameters given in the `$queryString`.	`yii\web\Request`
`getQueryString()`	Returns part of the request URL that is after the question mark.	`yii\web\Request`
`getRawBody()`	Returns the raw HTTP request body.	`yii\web\Request`
`getReferrer()`	Returns the URL referrer.	`yii\web\Request`
`getRemoteHost()`	Returns the host name of the other end of this connection.	`yii\web\Request`
`getRemoteIP()`	Returns the IP on the other end of this connection.	`yii\web\Request`
`getScriptFile()`	Returns the entry script file path.	`yii\web\Request`
`getScriptUrl()`	Returns the relative URL of the entry script.	`yii\web\Request`
`getSecurePort()`	Returns the port to use for secure requests.	`yii\web\Request`
`getServerName()`	Returns the server name.	`yii\web\Request`
`getServerPort()`	Returns the server port number. If a port is specified via a forwarding header (e.g. ‘X-Forwarded-Port’) and the remote host is a “trusted host” the that port will be used (see `$portHeaders`), otherwise the default server port will be returned.	`yii\web\Request`
`getUrl()`	Returns the currently requested relative URL.	`yii\web\Request`
`getUserAgent()`	Returns the user agent.	`yii\web\Request`
`getUserHost()`	Returns the user host name.	`yii\web\Request`
`getUserIP()`	Returns the user IP address.	`yii\web\Request`
`hasEventHandlers()`	Returns a value indicating whether there is any handler attached to the named event.	`yii\base\Component`
`hasMethod()`	Returns a value indicating whether a method is defined.	`yii\base\Component`
`hasProperty()`	Returns a value indicating whether a property is defined for this component.	`yii\base\Component`
`init()`	Initializes the object.	`yii\base\BaseObject`
`off()`	Detaches an existing event handler from this component.	`yii\base\Component`
`on()`	Attaches an event handler to an event.	`yii\base\Component`
`parseAcceptHeader()`	Parses the given `Accept` (or `Accept-Language`) header.	`yii\web\Request`
`post()`	Returns POST parameter with a given name. If name isn’t specified, returns an array of all POST parameters.	`yii\web\Request`
`resolve()`	Resolves the current request into a route and the associated parameters.	`yii\web\Request`
`setAcceptableContentTypes()`	Sets the acceptable content types.	`yii\web\Request`
`setAcceptableLanguages()`		`yii\web\Request`
`setBaseUrl()`	Sets the relative URL for the application.	`yii\web\Request`
`setBodyParams()`	Sets the request body parameters.	`yii\web\Request`
`setHostInfo()`	Sets the schema and host part of the application URL.	`yii\web\Request`
`setIsConsoleRequest()`	Sets the value indicating whether the current request is made via command line.	`yii\base\Request`
`setPathInfo()`	Sets the path info of the current request.	`yii\web\Request`
`setPort()`	Sets the port to use for insecure requests.	`yii\web\Request`
`setQueryParams()`	Sets the request `$queryString` parameters.	`yii\web\Request`
`setRawBody()`	Sets the raw HTTP request body, this method is mainly used by test scripts to simulate raw HTTP requests.	`yii\web\Request`
`setScriptFile()`	Sets the entry script file path.	`yii\web\Request`
`setScriptUrl()`	Sets the relative URL for the application entry script.	`yii\web\Request`
`setSecurePort()`	Sets the port to use for secure requests.	`yii\web\Request`
`setUrl()`	Sets the currently requested relative URL.	`yii\web\Request`
`trigger()`	Triggers an event.	`yii\base\Component`
`validateCsrfToken()`	Performs the CSRF validation.	`yii\web\Request`
`createCsrfCookie()` protected	Creates a cookie with a randomly generated CSRF token.	`yii\web\Request`
`filterHeaders()` protected	Filters headers according to the `$trustedHosts`.	`yii\web\Request`
`generateCsrfToken()` protected	Generates an unmasked random token used to perform CSRF validation.	`yii\web\Request`
`getIpValidator()` protected	Creates instance of `IpValidator`.	`yii\web\Request`
`getSecureForwardedHeaderParts()` protected	Returns decoded forwarded header	`yii\web\Request`
`getSecureForwardedHeaderTrustedPart()` protected	Gets first `Forwarded` header value for token	`yii\web\Request`
`getSecureForwardedHeaderTrustedParts()` protected	Gets only trusted `Forwarded` header parts	`yii\web\Request`
`getTrustedHeaders()` protected	Trusted headers according to the `$trustedHosts`.	`yii\web\Request`
`getUserIpFromIpHeader()` protected	Return user IP’s from IP header.	`yii\web\Request`
`getUserIpFromIpHeaders()` protected	Returns the user IP address from `$ipHeaders`.	`yii\web\Request`
`loadCookies()` protected	Converts `$_COOKIE` into an array of `Cookie`.	`yii\web\Request`
`loadCsrfToken()` protected	Loads the CSRF token from cookie or session.	`yii\web\Request`
`resolvePathInfo()` protected	Resolves the path info part of the currently requested URL.	`yii\web\Request`
`resolveRequestUri()` protected	Resolves the request URI portion for the currently requested URL.	`yii\web\Request`

Constants

Constant	Value	Description	Defined by
`CSRF_HEADER`	`'X-CSRF-Token'`	Default name of the HTTP header for sending CSRF token.	`yii\web\Request`

Method details

getCsrfTokenFromHeader()

public function getCsrfTokenFromHeader(): string|null

Returns the CSRF token sent via the X-XSRF-TOKEN header.

Returns

string|null: Masked token after signed-cookie validation, raw header when cookie validation is disabled, or null when the header is absent or fails signed-cookie validation.