# Request

> Configures CSRF protection for Inertia applications using the cookie-to-header pattern.

[API reference](/docs/api/index.md) › [Inertia](/docs/extensions/inertia/reference/index.md) › [web](/docs/extensions/inertia/reference/web/index.md) › Request

| class | `yii\inertia\web\Request` |
| --- | --- |
| Extends | [`yii\web\Request`](/docs/api/yii/web/request/index.md) » [`yii\base\Request`](/docs/api/yii/base/request/index.md) » [`yii\base\Component`](/docs/api/yii/base/component/index.md) » [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| Implements | [`yii\base\Configurable`](/docs/api/yii/base/configurable/index.md) |
| Source | [`src/web/Request.php`](https://github.com/yii2-extensions/inertia/blob/main/src/web/Request.php#L18) |

Configures CSRF protection for Inertia applications using the cookie-to-header pattern.

## Properties

| Property | Type | Description | Defined by |
| --- | --- | --- | --- |
| <span id="property-absoluteUrl"></span>[`$absoluteUrl`](/docs/api/yii/web/request/index.md#property-absoluteUrl) read-only | `string` | The currently requested absolute URL. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-acceptableContentTypes"></span>[`$acceptableContentTypes`](/docs/api/yii/web/request/index.md#property-acceptableContentTypes) | `array` | The content types ordered by the quality score. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-acceptableLanguages"></span>[`$acceptableLanguages`](/docs/api/yii/web/request/index.md#property-acceptableLanguages) | `array` | The languages ordered by the preference level. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-authCredentials"></span>[`$authCredentials`](/docs/api/yii/web/request/index.md#property-authCredentials) read-only | `array` | That contains exactly two elements: - 0: the username sent via HTTP authentication, `null` if the username is not given - 1: the password sent via HTTP authentication, `null` if the password is not given. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-authPassword"></span>[`$authPassword`](/docs/api/yii/web/request/index.md#property-authPassword) read-only | `string\|null` | The password sent via HTTP authentication, `null` if the password is not given. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-authUser"></span>[`$authUser`](/docs/api/yii/web/request/index.md#property-authUser) read-only | `string\|null` | The username sent via HTTP authentication, `null` if the username is not given. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-baseUrl"></span>[`$baseUrl`](/docs/api/yii/web/request/index.md#property-baseUrl) | `string` | The relative URL for the application. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-behaviors"></span>[`$behaviors`](/docs/api/yii/base/component/index.md#property-behaviors) read-only | `array<`[`yii\base\Behavior`](/docs/api/yii/base/behavior/index.md)`<static>>` | List of behaviors attached to this component. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="property-bodyParams"></span>[`$bodyParams`](/docs/api/yii/web/request/index.md#property-bodyParams) | `mixed` | The request parameters given in the request body. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-contentType"></span>[`$contentType`](/docs/api/yii/web/request/index.md#property-contentType) read-only | `string` | Request content-type. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-cookies"></span>[`$cookies`](/docs/api/yii/web/request/index.md#property-cookies) read-only | [`yii\web\CookieCollection`](/docs/api/yii/web/cookiecollection/index.md) | The cookie collection. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-cookieValidationKey"></span>[`$cookieValidationKey`](/docs/api/yii/web/request/index.md#property-cookieValidationKey) | `string` | A secret key used for cookie validation. Default: `null`. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-csrfCookie"></span>`$csrfCookie` | `mixed[]` | Cookie options. `httpOnly` is `false` so JavaScript can read the CSRF token. Default: `['httpOnly' => false]`. | `Request` |
| <span id="property-csrfHeader"></span>`$csrfHeader` |  | Header checked for the CSRF token sent by Inertia's HTTP client. Default: `'X-XSRF-TOKEN'`. | `Request` |
| <span id="property-csrfHeaderUnsafeMethods"></span>[`$csrfHeaderUnsafeMethods`](/docs/api/yii/web/request/index.md#property-csrfHeaderUnsafeMethods) | `array` | "unsafe" methods not triggered a CORS-preflight request This property is used only when both [`$enableCsrfValidation`](/docs/api/yii/web/request/index.md#property-enableCsrfValidation) and [`$validateCsrfHeaderOnly`](/docs/api/yii/web/request/index.md#property-validateCsrfHeaderOnly) are true. Default: `['GET', 'HEAD', 'POST']`. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-csrfParam"></span>`$csrfParam` |  | Cookie name and form parameter name for the CSRF token. Default: `'XSRF-TOKEN'`. | `Request` |
| <span id="property-csrfToken"></span>[`$csrfToken`](/docs/api/yii/web/request/index.md#property-csrfToken) read-only | `null\|string` | The token used to perform CSRF validation. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-csrfTokenFromHeader"></span>[`$csrfTokenFromHeader`](/docs/api/yii/web/request/index.md#property-csrfTokenFromHeader) read-only | `string\|null` | The CSRF token sent via [`$csrfHeader`](/docs/api/yii/web/request/index.md#property-csrfHeader) by browser. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-csrfTokenSafeMethods"></span>[`$csrfTokenSafeMethods`](/docs/api/yii/web/request/index.md#property-csrfTokenSafeMethods) | `array` | The name of the HTTP header for sending CSRF token. by default validate CSRF token on non-"safe" methods only This property is used only when [`$enableCsrfValidation`](/docs/api/yii/web/request/index.md#property-enableCsrfValidation) is true. Default: `['GET', 'HEAD', 'OPTIONS']`. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-enableCookieValidation"></span>[`$enableCookieValidation`](/docs/api/yii/web/request/index.md#property-enableCookieValidation) | `bool` | Whether cookies should be validated to ensure they are not tampered. Default: `true`. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-enableCsrfCookie"></span>[`$enableCsrfCookie`](/docs/api/yii/web/request/index.md#property-enableCsrfCookie) | `bool` | Whether to use cookie to persist CSRF token. Default: `true`. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-enableCsrfValidation"></span>[`$enableCsrfValidation`](/docs/api/yii/web/request/index.md#property-enableCsrfValidation) | `bool` | Whether to enable CSRF (Cross-Site Request Forgery) validation. Default: `true`. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-eTags"></span>[`$eTags`](/docs/api/yii/web/request/index.md#property-eTags) read-only | `array` | The entity tags. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-headers"></span>[`$headers`](/docs/api/yii/web/request/index.md#property-headers) read-only | [`yii\web\HeaderCollection`](/docs/api/yii/web/headercollection/index.md) | The header collection. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-hostInfo"></span>[`$hostInfo`](/docs/api/yii/web/request/index.md#property-hostInfo) | `string\|null` | Schema and hostname part (with port number if needed) of the request URL (e.g. `https://www.yiiframework.com`), null if can't be obtained from `$_SERVER` and wasn't set. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-hostName"></span>[`$hostName`](/docs/api/yii/web/request/index.md#property-hostName) read-only | `string\|null` | Hostname part of the request URL (e.g. `www.yiiframework.com`). | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-ipHeaders"></span>[`$ipHeaders`](/docs/api/yii/web/request/index.md#property-ipHeaders) | `string[]` | List of headers where proxies store the real client IP. Default: `['X-Forwarded-For']`. Available since 2.0.13. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-isAjax"></span>[`$isAjax`](/docs/api/yii/web/request/index.md#property-isAjax) read-only | `bool` | Whether this is an AJAX (XMLHttpRequest) request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-isConsoleRequest"></span>[`$isConsoleRequest`](/docs/api/yii/base/request/index.md#property-isConsoleRequest) | `bool` | The value indicating whether the current request is made via console. | [`yii\base\Request`](/docs/api/yii/base/request/index.md) |
| <span id="property-isDelete"></span>[`$isDelete`](/docs/api/yii/web/request/index.md#property-isDelete) read-only | `bool` | Whether this is a DELETE request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-isFlash"></span>[`$isFlash`](/docs/api/yii/web/request/index.md#property-isFlash) read-only | `bool` | Whether this is an Adobe Flash or Adobe Flex request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-isGet"></span>[`$isGet`](/docs/api/yii/web/request/index.md#property-isGet) read-only | `bool` | Whether this is a GET request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-isHead"></span>[`$isHead`](/docs/api/yii/web/request/index.md#property-isHead) read-only | `bool` | Whether this is a HEAD request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-isOptions"></span>[`$isOptions`](/docs/api/yii/web/request/index.md#property-isOptions) read-only | `bool` | Whether this is a OPTIONS request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-isPatch"></span>[`$isPatch`](/docs/api/yii/web/request/index.md#property-isPatch) read-only | `bool` | Whether this is a PATCH request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-isPjax"></span>[`$isPjax`](/docs/api/yii/web/request/index.md#property-isPjax) read-only | `bool` | Whether this is a PJAX request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-isPost"></span>[`$isPost`](/docs/api/yii/web/request/index.md#property-isPost) read-only | `bool` | Whether this is a POST request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-isPut"></span>[`$isPut`](/docs/api/yii/web/request/index.md#property-isPut) read-only | `bool` | Whether this is a PUT request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-isSecureConnection"></span>[`$isSecureConnection`](/docs/api/yii/web/request/index.md#property-isSecureConnection) read-only | `bool` | If the request is sent via secure channel (https). | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-method"></span>[`$method`](/docs/api/yii/web/request/index.md#property-method) read-only | `string` | Request method, such as GET, POST, HEAD, PUT, PATCH, DELETE. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-methodParam"></span>[`$methodParam`](/docs/api/yii/web/request/index.md#property-methodParam) | `string` | The name of the POST parameter that is used to indicate if a request is a PUT, PATCH or DELETE request tunneled through POST. Default: `'_method'`. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-origin"></span>[`$origin`](/docs/api/yii/web/request/index.md#property-origin) read-only | `string\|null` | URL origin of a CORS request, `null` if not available. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-parsers"></span>[`$parsers`](/docs/api/yii/web/request/index.md#property-parsers) | `array` | The parsers for converting the raw HTTP request body into [`$bodyParams`](/docs/api/yii/web/request/index.md#property-bodyParams). Default: `[]`. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-pathInfo"></span>[`$pathInfo`](/docs/api/yii/web/request/index.md#property-pathInfo) | `string` | Part of the request URL that is after the entry script and before the question mark. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-port"></span>[`$port`](/docs/api/yii/web/request/index.md#property-port) | `int` | Port number for insecure requests. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-portHeaders"></span>[`$portHeaders`](/docs/api/yii/web/request/index.md#property-portHeaders) | `string[]` | List of headers where proxies store the real request port. Default: `['X-Forwarded-Port']`. Available since 2.0.46. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-preferredLanguage"></span>[`$preferredLanguage`](/docs/api/yii/web/request/index.md#property-preferredLanguage) read-only | `string` | The language that the application should use. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-queryParams"></span>[`$queryParams`](/docs/api/yii/web/request/index.md#property-queryParams) | `array` | The request GET parameter values. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-queryString"></span>[`$queryString`](/docs/api/yii/web/request/index.md#property-queryString) read-only | `string` | Part of the request URL that is after the question mark. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-rawBody"></span>[`$rawBody`](/docs/api/yii/web/request/index.md#property-rawBody) | `string` | The request body. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-referrer"></span>[`$referrer`](/docs/api/yii/web/request/index.md#property-referrer) read-only | `string\|null` | URL referrer, null if not available. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-remoteHost"></span>[`$remoteHost`](/docs/api/yii/web/request/index.md#property-remoteHost) read-only | `string\|null` | Remote host name, `null` if not available. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-remoteIP"></span>[`$remoteIP`](/docs/api/yii/web/request/index.md#property-remoteIP) read-only | `string\|null` | Remote IP address, `null` if not available. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-scriptFile"></span>[`$scriptFile`](/docs/api/yii/web/request/index.md#property-scriptFile) | `string` | The entry script file path. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-scriptUrl"></span>[`$scriptUrl`](/docs/api/yii/web/request/index.md#property-scriptUrl) | `string` | The relative URL of the entry script. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-secureHeaders"></span>[`$secureHeaders`](/docs/api/yii/web/request/index.md#property-secureHeaders) | `array` | Lists of headers that are, by default, subject to the trusted host configuration. Default: `['X-Forwarded-For', 'X-Forwarded-Host', 'X-Forwarded-Proto', 'X-Forwarded-Port', 'Front-End-Https', 'X-Rewrite-Url', 'X-Original-Host']`. Available since 2.0.13. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-securePort"></span>[`$securePort`](/docs/api/yii/web/request/index.md#property-securePort) | `int` | Port number for secure requests. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-secureProtocolHeaders"></span>[`$secureProtocolHeaders`](/docs/api/yii/web/request/index.md#property-secureProtocolHeaders) | `array` | List of headers to check for determining whether the connection is made via HTTPS. Default: `['X-Forwarded-Proto' => ['https'], 'Front-End-Https' => ['on']]`. Available since 2.0.13. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-serverName"></span>[`$serverName`](/docs/api/yii/web/request/index.md#property-serverName) read-only | `string\|null` | Server name, null if not available. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-serverPort"></span>[`$serverPort`](/docs/api/yii/web/request/index.md#property-serverPort) read-only | `int\|null` | Server port number, null if not available. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-trustedHosts"></span>[`$trustedHosts`](/docs/api/yii/web/request/index.md#property-trustedHosts) | `array` | The configuration for trusted security related headers. Default: `[]`. Available since 2.0.13. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-url"></span>[`$url`](/docs/api/yii/web/request/index.md#property-url) | `string` | The currently requested relative URL. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-userAgent"></span>[`$userAgent`](/docs/api/yii/web/request/index.md#property-userAgent) read-only | `string\|null` | User agent, null if not available. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-userHost"></span>[`$userHost`](/docs/api/yii/web/request/index.md#property-userHost) read-only | `string\|null` | User host name, null if not available. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-userIP"></span>[`$userIP`](/docs/api/yii/web/request/index.md#property-userIP) read-only | `string\|null` | User IP address, null if not available. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="property-validateCsrfHeaderOnly"></span>[`$validateCsrfHeaderOnly`](/docs/api/yii/web/request/index.md#property-validateCsrfHeaderOnly) | `bool` | Whether to use custom header only to CSRF validation of SPA. Default: `false`. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |

## Methods

| Method | Description | Defined by |
| --- | --- | --- |
| <span id="method-__construct"></span>[`__construct()`](/docs/api/yii/base/baseobject/index.md#method-__construct) | Constructor. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-__call"></span>[`__call()`](/docs/api/yii/base/component/index.md#method-__call) | Calls the named method which is not a class method. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-__clone"></span>[`__clone()`](/docs/api/yii/base/component/index.md#method-__clone) | This method is called after the object is created by cloning an existing one. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-__get"></span>[`__get()`](/docs/api/yii/base/component/index.md#method-__get) | Returns the value of a component property. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-__isset"></span>[`__isset()`](/docs/api/yii/base/component/index.md#method-__isset) | Checks if a property is set, i.e. defined and not null. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-__set"></span>[`__set()`](/docs/api/yii/base/component/index.md#method-__set) | Sets the value of a component property. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-__unset"></span>[`__unset()`](/docs/api/yii/base/component/index.md#method-__unset) | Sets a component property to be null. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-attachBehavior"></span>[`attachBehavior()`](/docs/api/yii/base/component/index.md#method-attachBehavior) | Attaches a behavior to this component. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-attachBehaviors"></span>[`attachBehaviors()`](/docs/api/yii/base/component/index.md#method-attachBehaviors) | Attaches a list of behaviors to the component. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-behaviors"></span>[`behaviors()`](/docs/api/yii/base/component/index.md#method-behaviors) | Returns a list of behaviors that this component should behave as. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-canGetProperty"></span>[`canGetProperty()`](/docs/api/yii/base/component/index.md#method-canGetProperty) | Returns a value indicating whether a property can be read. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-canSetProperty"></span>[`canSetProperty()`](/docs/api/yii/base/component/index.md#method-canSetProperty) | Returns a value indicating whether a property can be set. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-className"></span>[`className()`](/docs/api/yii/base/baseobject/index.md#method-className) static | Returns the fully qualified name of this class. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-detachBehavior"></span>[`detachBehavior()`](/docs/api/yii/base/component/index.md#method-detachBehavior) | Detaches a behavior from the component. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-detachBehaviors"></span>[`detachBehaviors()`](/docs/api/yii/base/component/index.md#method-detachBehaviors) | Detaches all behaviors from the component. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-ensureBehaviors"></span>[`ensureBehaviors()`](/docs/api/yii/base/component/index.md#method-ensureBehaviors) | Makes sure that the behaviors declared in [`behaviors()`](/docs/api/yii/base/component/index.md#method-behaviors) are attached to this component. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-get"></span>[`get()`](/docs/api/yii/web/request/index.md#method-get) | Returns GET parameter with a given name. If name isn't specified, returns an array of all GET parameters. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getAbsoluteUrl"></span>[`getAbsoluteUrl()`](/docs/api/yii/web/request/index.md#method-getAbsoluteUrl) | Returns the currently requested absolute URL. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getAcceptableContentTypes"></span>[`getAcceptableContentTypes()`](/docs/api/yii/web/request/index.md#method-getAcceptableContentTypes) | Returns the content types acceptable by the end user. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getAcceptableLanguages"></span>[`getAcceptableLanguages()`](/docs/api/yii/web/request/index.md#method-getAcceptableLanguages) | Returns the languages acceptable by the end user. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getAuthCredentials"></span>[`getAuthCredentials()`](/docs/api/yii/web/request/index.md#method-getAuthCredentials) |  | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getAuthPassword"></span>[`getAuthPassword()`](/docs/api/yii/web/request/index.md#method-getAuthPassword) |  | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getAuthUser"></span>[`getAuthUser()`](/docs/api/yii/web/request/index.md#method-getAuthUser) |  | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getBaseUrl"></span>[`getBaseUrl()`](/docs/api/yii/web/request/index.md#method-getBaseUrl) | Returns the relative URL for the application. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getBehavior"></span>[`getBehavior()`](/docs/api/yii/base/component/index.md#method-getBehavior) | Returns the named behavior object. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-getBehaviors"></span>[`getBehaviors()`](/docs/api/yii/base/component/index.md#method-getBehaviors) | Returns all behaviors attached to this component. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-getBodyParam"></span>[`getBodyParam()`](/docs/api/yii/web/request/index.md#method-getBodyParam) | Returns the named request body parameter value. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getBodyParams"></span>[`getBodyParams()`](/docs/api/yii/web/request/index.md#method-getBodyParams) | Returns the request parameters given in the request body. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getContentType"></span>[`getContentType()`](/docs/api/yii/web/request/index.md#method-getContentType) | Returns request content-type The Content-Type header field indicates the MIME type of the data contained in [`getRawBody()`](/docs/api/yii/web/request/index.md#method-getRawBody) or, in the case of the HEAD method, the media type that would have been sent had the request been a GET. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getCookies"></span>[`getCookies()`](/docs/api/yii/web/request/index.md#method-getCookies) | Returns the cookie collection. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getCsrfToken"></span>[`getCsrfToken()`](/docs/api/yii/web/request/index.md#method-getCsrfToken) | Returns the token used to perform CSRF validation. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| [`getCsrfTokenFromHeader()`](#method-getCsrfTokenFromHeader) | Returns the CSRF token sent via the `X-XSRF-TOKEN` header. | `Request` |
| <span id="method-getETags"></span>[`getETags()`](/docs/api/yii/web/request/index.md#method-getETags) | Gets the Etags. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getHeaders"></span>[`getHeaders()`](/docs/api/yii/web/request/index.md#method-getHeaders) | Returns the header collection. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getHostInfo"></span>[`getHostInfo()`](/docs/api/yii/web/request/index.md#method-getHostInfo) | Returns the schema and host part of the current request URL. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getHostName"></span>[`getHostName()`](/docs/api/yii/web/request/index.md#method-getHostName) | Returns the host part of the current request URL. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getIsAjax"></span>[`getIsAjax()`](/docs/api/yii/web/request/index.md#method-getIsAjax) | Returns whether this is an AJAX (XMLHttpRequest) request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getIsConsoleRequest"></span>[`getIsConsoleRequest()`](/docs/api/yii/base/request/index.md#method-getIsConsoleRequest) | Returns a value indicating whether the current request is made via command line. | [`yii\base\Request`](/docs/api/yii/base/request/index.md) |
| <span id="method-getIsDelete"></span>[`getIsDelete()`](/docs/api/yii/web/request/index.md#method-getIsDelete) | Returns whether this is a DELETE request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getIsFlash"></span>[`getIsFlash()`](/docs/api/yii/web/request/index.md#method-getIsFlash) | Returns whether this is an Adobe Flash or Flex request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getIsGet"></span>[`getIsGet()`](/docs/api/yii/web/request/index.md#method-getIsGet) | Returns whether this is a GET request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getIsHead"></span>[`getIsHead()`](/docs/api/yii/web/request/index.md#method-getIsHead) | Returns whether this is a HEAD request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getIsOptions"></span>[`getIsOptions()`](/docs/api/yii/web/request/index.md#method-getIsOptions) | Returns whether this is an OPTIONS request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getIsPatch"></span>[`getIsPatch()`](/docs/api/yii/web/request/index.md#method-getIsPatch) | Returns whether this is a PATCH request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getIsPjax"></span>[`getIsPjax()`](/docs/api/yii/web/request/index.md#method-getIsPjax) | Returns whether this is a PJAX request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getIsPost"></span>[`getIsPost()`](/docs/api/yii/web/request/index.md#method-getIsPost) | Returns whether this is a POST request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getIsPut"></span>[`getIsPut()`](/docs/api/yii/web/request/index.md#method-getIsPut) | Returns whether this is a PUT request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getIsSecureConnection"></span>[`getIsSecureConnection()`](/docs/api/yii/web/request/index.md#method-getIsSecureConnection) | Return if the request is sent via secure channel (https). | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getMethod"></span>[`getMethod()`](/docs/api/yii/web/request/index.md#method-getMethod) | Returns the method of the current request (e.g. GET, POST, HEAD, PUT, PATCH, DELETE). | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getOrigin"></span>[`getOrigin()`](/docs/api/yii/web/request/index.md#method-getOrigin) | Returns the URL origin of a CORS request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getPathInfo"></span>[`getPathInfo()`](/docs/api/yii/web/request/index.md#method-getPathInfo) | Returns the path info of the currently requested URL. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getPort"></span>[`getPort()`](/docs/api/yii/web/request/index.md#method-getPort) | Returns the port to use for insecure requests. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getPreferredLanguage"></span>[`getPreferredLanguage()`](/docs/api/yii/web/request/index.md#method-getPreferredLanguage) | Returns the user-preferred language that should be used by this application. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getQueryParam"></span>[`getQueryParam()`](/docs/api/yii/web/request/index.md#method-getQueryParam) | Returns the named GET parameter value. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getQueryParams"></span>[`getQueryParams()`](/docs/api/yii/web/request/index.md#method-getQueryParams) | Returns the request parameters given in the [`$queryString`](/docs/api/yii/web/request/index.md#property-queryString). | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getQueryString"></span>[`getQueryString()`](/docs/api/yii/web/request/index.md#method-getQueryString) | Returns part of the request URL that is after the question mark. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getRawBody"></span>[`getRawBody()`](/docs/api/yii/web/request/index.md#method-getRawBody) | Returns the raw HTTP request body. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getReferrer"></span>[`getReferrer()`](/docs/api/yii/web/request/index.md#method-getReferrer) | Returns the URL referrer. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getRemoteHost"></span>[`getRemoteHost()`](/docs/api/yii/web/request/index.md#method-getRemoteHost) | Returns the host name of the other end of this connection. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getRemoteIP"></span>[`getRemoteIP()`](/docs/api/yii/web/request/index.md#method-getRemoteIP) | Returns the IP on the other end of this connection. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getScriptFile"></span>[`getScriptFile()`](/docs/api/yii/web/request/index.md#method-getScriptFile) | Returns the entry script file path. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getScriptUrl"></span>[`getScriptUrl()`](/docs/api/yii/web/request/index.md#method-getScriptUrl) | Returns the relative URL of the entry script. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getSecurePort"></span>[`getSecurePort()`](/docs/api/yii/web/request/index.md#method-getSecurePort) | Returns the port to use for secure requests. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getServerName"></span>[`getServerName()`](/docs/api/yii/web/request/index.md#method-getServerName) | Returns the server name. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getServerPort"></span>[`getServerPort()`](/docs/api/yii/web/request/index.md#method-getServerPort) | Returns the server port number. If a port is specified via a forwarding header (e.g. 'X-Forwarded-Port') and the remote host is a "trusted host" the that port will be used (see [`$portHeaders`](/docs/api/yii/web/request/index.md#property-portHeaders)), otherwise the default server port will be returned. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getUrl"></span>[`getUrl()`](/docs/api/yii/web/request/index.md#method-getUrl) | Returns the currently requested relative URL. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getUserAgent"></span>[`getUserAgent()`](/docs/api/yii/web/request/index.md#method-getUserAgent) | Returns the user agent. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getUserHost"></span>[`getUserHost()`](/docs/api/yii/web/request/index.md#method-getUserHost) | Returns the user host name. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getUserIP"></span>[`getUserIP()`](/docs/api/yii/web/request/index.md#method-getUserIP) | Returns the user IP address. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-hasEventHandlers"></span>[`hasEventHandlers()`](/docs/api/yii/base/component/index.md#method-hasEventHandlers) | Returns a value indicating whether there is any handler attached to the named event. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-hasMethod"></span>[`hasMethod()`](/docs/api/yii/base/component/index.md#method-hasMethod) | Returns a value indicating whether a method is defined. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-hasProperty"></span>[`hasProperty()`](/docs/api/yii/base/component/index.md#method-hasProperty) | Returns a value indicating whether a property is defined for this component. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-init"></span>[`init()`](/docs/api/yii/base/baseobject/index.md#method-init) | Initializes the object. | [`yii\base\BaseObject`](/docs/api/yii/base/baseobject/index.md) |
| <span id="method-off"></span>[`off()`](/docs/api/yii/base/component/index.md#method-off) | Detaches an existing event handler from this component. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-on"></span>[`on()`](/docs/api/yii/base/component/index.md#method-on) | Attaches an event handler to an event. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-parseAcceptHeader"></span>[`parseAcceptHeader()`](/docs/api/yii/web/request/index.md#method-parseAcceptHeader) | Parses the given `Accept` (or `Accept-Language`) header. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-post"></span>[`post()`](/docs/api/yii/web/request/index.md#method-post) | Returns POST parameter with a given name. If name isn't specified, returns an array of all POST parameters. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-resolve"></span>[`resolve()`](/docs/api/yii/web/request/index.md#method-resolve) | Resolves the current request into a route and the associated parameters. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-setAcceptableContentTypes"></span>[`setAcceptableContentTypes()`](/docs/api/yii/web/request/index.md#method-setAcceptableContentTypes) | Sets the acceptable content types. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-setAcceptableLanguages"></span>[`setAcceptableLanguages()`](/docs/api/yii/web/request/index.md#method-setAcceptableLanguages) |  | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-setBaseUrl"></span>[`setBaseUrl()`](/docs/api/yii/web/request/index.md#method-setBaseUrl) | Sets the relative URL for the application. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-setBodyParams"></span>[`setBodyParams()`](/docs/api/yii/web/request/index.md#method-setBodyParams) | Sets the request body parameters. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-setHostInfo"></span>[`setHostInfo()`](/docs/api/yii/web/request/index.md#method-setHostInfo) | Sets the schema and host part of the application URL. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-setIsConsoleRequest"></span>[`setIsConsoleRequest()`](/docs/api/yii/base/request/index.md#method-setIsConsoleRequest) | Sets the value indicating whether the current request is made via command line. | [`yii\base\Request`](/docs/api/yii/base/request/index.md) |
| <span id="method-setPathInfo"></span>[`setPathInfo()`](/docs/api/yii/web/request/index.md#method-setPathInfo) | Sets the path info of the current request. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-setPort"></span>[`setPort()`](/docs/api/yii/web/request/index.md#method-setPort) | Sets the port to use for insecure requests. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-setQueryParams"></span>[`setQueryParams()`](/docs/api/yii/web/request/index.md#method-setQueryParams) | Sets the request [`$queryString`](/docs/api/yii/web/request/index.md#property-queryString) parameters. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-setRawBody"></span>[`setRawBody()`](/docs/api/yii/web/request/index.md#method-setRawBody) | Sets the raw HTTP request body, this method is mainly used by test scripts to simulate raw HTTP requests. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-setScriptFile"></span>[`setScriptFile()`](/docs/api/yii/web/request/index.md#method-setScriptFile) | Sets the entry script file path. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-setScriptUrl"></span>[`setScriptUrl()`](/docs/api/yii/web/request/index.md#method-setScriptUrl) | Sets the relative URL for the application entry script. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-setSecurePort"></span>[`setSecurePort()`](/docs/api/yii/web/request/index.md#method-setSecurePort) | Sets the port to use for secure requests. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-setUrl"></span>[`setUrl()`](/docs/api/yii/web/request/index.md#method-setUrl) | Sets the currently requested relative URL. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-trigger"></span>[`trigger()`](/docs/api/yii/base/component/index.md#method-trigger) | Triggers an event. | [`yii\base\Component`](/docs/api/yii/base/component/index.md) |
| <span id="method-validateCsrfToken"></span>[`validateCsrfToken()`](/docs/api/yii/web/request/index.md#method-validateCsrfToken) | Performs the CSRF validation. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-createCsrfCookie"></span>[`createCsrfCookie()`](/docs/api/yii/web/request/index.md#method-createCsrfCookie) protected | Creates a cookie with a randomly generated CSRF token. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-filterHeaders"></span>[`filterHeaders()`](/docs/api/yii/web/request/index.md#method-filterHeaders) protected | Filters headers according to the [`$trustedHosts`](/docs/api/yii/web/request/index.md#property-trustedHosts). | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-generateCsrfToken"></span>[`generateCsrfToken()`](/docs/api/yii/web/request/index.md#method-generateCsrfToken) protected | Generates an unmasked random token used to perform CSRF validation. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getIpValidator"></span>[`getIpValidator()`](/docs/api/yii/web/request/index.md#method-getIpValidator) protected | Creates instance of [`IpValidator`](/docs/api/yii/validators/ipvalidator/index.md). | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getSecureForwardedHeaderParts"></span>[`getSecureForwardedHeaderParts()`](/docs/api/yii/web/request/index.md#method-getSecureForwardedHeaderParts) protected | Returns decoded forwarded header | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getSecureForwardedHeaderTrustedPart"></span>[`getSecureForwardedHeaderTrustedPart()`](/docs/api/yii/web/request/index.md#method-getSecureForwardedHeaderTrustedPart) protected | Gets first `Forwarded` header value for token | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getSecureForwardedHeaderTrustedParts"></span>[`getSecureForwardedHeaderTrustedParts()`](/docs/api/yii/web/request/index.md#method-getSecureForwardedHeaderTrustedParts) protected | Gets only trusted `Forwarded` header parts | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getTrustedHeaders"></span>[`getTrustedHeaders()`](/docs/api/yii/web/request/index.md#method-getTrustedHeaders) protected | Trusted headers according to the [`$trustedHosts`](/docs/api/yii/web/request/index.md#property-trustedHosts). | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getUserIpFromIpHeader"></span>[`getUserIpFromIpHeader()`](/docs/api/yii/web/request/index.md#method-getUserIpFromIpHeader) protected | Return user IP's from IP header. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-getUserIpFromIpHeaders"></span>[`getUserIpFromIpHeaders()`](/docs/api/yii/web/request/index.md#method-getUserIpFromIpHeaders) protected | Returns the user IP address from [`$ipHeaders`](/docs/api/yii/web/request/index.md#property-ipHeaders). | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-loadCookies"></span>[`loadCookies()`](/docs/api/yii/web/request/index.md#method-loadCookies) protected | Converts `$_COOKIE` into an array of [`Cookie`](/docs/api/yii/web/cookie/index.md). | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-loadCsrfToken"></span>[`loadCsrfToken()`](/docs/api/yii/web/request/index.md#method-loadCsrfToken) protected | Loads the CSRF token from cookie or session. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-resolvePathInfo"></span>[`resolvePathInfo()`](/docs/api/yii/web/request/index.md#method-resolvePathInfo) protected | Resolves the path info part of the currently requested URL. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |
| <span id="method-resolveRequestUri"></span>[`resolveRequestUri()`](/docs/api/yii/web/request/index.md#method-resolveRequestUri) protected | Resolves the request URI portion for the currently requested URL. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |

## Constants

| Constant | Value | Description | Defined by |
| --- | --- | --- | --- |
| <span id="const-CSRF_HEADER"></span>[`CSRF_HEADER`](/docs/api/yii/web/request/index.md#const-CSRF_HEADER) | `'X-CSRF-Token'` | Default name of the HTTP header for sending CSRF token. | [`yii\web\Request`](/docs/api/yii/web/request/index.md) |

## Method details

### getCsrfTokenFromHeader() <span id="method-getCsrfTokenFromHeader"></span>

```php
public function getCsrfTokenFromHeader(): string|null
```

Returns the CSRF token sent via the `X-XSRF-TOKEN` header.

**Returns**

`string|null`: Masked token after signed-cookie validation, raw header when cookie validation is disabled, or `null` when the header is absent or fails signed-cookie validation.