Skip to content
PHP Ecosystem
Explore

Request

API reference › PSR bridge › http › Request

classyii2\extensions\psrbridge\http\Request
Extendsyii\web\Request » yii\base\Request » yii\base\Component » yii\base\BaseObject
Implementsyii\base\Configurable
Sourcesrc/http/Request.php

Extends Yii request handling with PSR-7 request data.

ServerRequestAdapter PSR-7 to Yii request adapter.

PropertyTypeDescriptionDefined by
$absoluteUrl read-onlystringThe currently requested absolute URL.yii\web\Request
$acceptableContentTypesarrayThe content types ordered by the quality score.yii\web\Request
$acceptableLanguagesarrayThe languages ordered by the preference level.yii\web\Request
$authCredentials read-onlyarrayThat contains exactly two elements: - 0: the username sent via HTTP authentication, null if the username is not given - 1: the password sent via HTTP authentication, null if the password is not given.yii\web\Request
$authPassword read-onlystring|nullThe password sent via HTTP authentication, null if the password is not given.yii\web\Request
$authUser read-onlystring|nullThe username sent via HTTP authentication, null if the username is not given.yii\web\Request
$baseUrlstringThe relative URL for the application.yii\web\Request
$behaviors read-onlyarray<yii\base\Behavior<static>>List of behaviors attached to this component.yii\base\Component
$bodyParamsmixedThe request parameters given in the request body.yii\web\Request
$contentType read-onlystringRequest content-type.yii\web\Request
$cookies read-onlyyii\web\CookieCollectionThe cookie collection.yii\web\Request
$cookieValidationKeystringA secret key used for cookie validation. Default: ''.Request
$csrfCookiearrayThe configuration for creating the CSRF cookie. Default: ['httpOnly' => true].yii\web\Request
$csrfHeaderstringThe name of the HTTP header for sending CSRF token. Default: self::CSRF_HEADER.yii\web\Request
$csrfHeaderUnsafeMethodsarray“unsafe” methods not triggered a CORS-preflight request This property is used only when both $enableCsrfValidation and $validateCsrfHeaderOnly are true. Default: ['GET', 'HEAD', 'POST'].yii\web\Request
$csrfParamstringThe name of the token used to prevent CSRF. Default: '_csrf'.yii\web\Request
$csrfToken read-onlynull|stringThe token used to perform CSRF validation.yii\web\Request
$csrfTokenFromHeader read-onlystring|nullThe CSRF token sent via $csrfHeader by browser.yii\web\Request
$csrfTokenSafeMethodsarrayThe name of the HTTP header for sending CSRF token. by default validate CSRF token on non-”safe” methods only This property is used only when $enableCsrfValidation is true. Default: ['GET', 'HEAD', 'OPTIONS'].yii\web\Request
$enableCookieValidationboolWhether cookies should be validated to ensure they are not tampered. Default: true.yii\web\Request
$enableCsrfCookieboolWhether to use cookie to persist CSRF token. Default: true.yii\web\Request
$enableCsrfValidationboolWhether to enable CSRF (Cross-Site Request Forgery) validation. Default: true.yii\web\Request
$eTags read-onlyarrayThe entity tags.yii\web\Request
$headers read-onlyyii\web\HeaderCollectionThe header collection.yii\web\Request
$hostInfostring|nullSchema and hostname part (with port number if needed) of the request URL (e.g. https://www.yiiframework.com), null if can’t be obtained from $_SERVER and wasn’t set.yii\web\Request
$hostName read-onlystring|nullHostname part of the request URL (e.g. www.yiiframework.com).yii\web\Request
$ipHeadersstring[]List of headers where proxies store the real client IP. Default: ['X-Forwarded-For']. Available since 2.0.13.yii\web\Request
$isAjax read-onlyboolWhether this is an AJAX (XMLHttpRequest) request.yii\web\Request
$isConsoleRequestboolThe value indicating whether the current request is made via console.yii\base\Request
$isDelete read-onlyboolWhether this is a DELETE request.yii\web\Request
$isFlash read-onlyboolWhether this is an Adobe Flash or Adobe Flex request.yii\web\Request
$isGet read-onlyboolWhether this is a GET request.yii\web\Request
$isHead read-onlyboolWhether this is a HEAD request.yii\web\Request
$isOptions read-onlyboolWhether this is a OPTIONS request.yii\web\Request
$isPatch read-onlyboolWhether this is a PATCH request.yii\web\Request
$isPjax read-onlyboolWhether this is a PJAX request.yii\web\Request
$isPost read-onlyboolWhether this is a POST request.yii\web\Request
$isPut read-onlyboolWhether this is a PUT request.yii\web\Request
$isSecureConnection read-onlyboolIf the request is sent via secure channel (https).yii\web\Request
$method read-onlystringRequest method, such as GET, POST, HEAD, PUT, PATCH, DELETE.yii\web\Request
$methodParamstringThe name of the POST parameter that is used to indicate if a request is a PUT, PATCH or DELETE request tunneled through POST. Default: '_method'.yii\web\Request
$origin read-onlystring|nullURL origin of a CORS request, null if not available.yii\web\Request
$parsedBody read-onlymixed[]|object|nullParsed body; absent or discarded scalar bodies yield null.Request
$parsersarray<string, class-string<object>|array{class?: class-string<object>, __class?: class-string<object>}|callable(): object>Parser definitions keyed by Content-Type.Request
$pathInfostringPart of the request URL that is after the entry script and before the question mark.yii\web\Request
$portintPort number for insecure requests.yii\web\Request
$portHeadersstring[]List of headers where proxies store the real request port. Default: ['X-Forwarded-Port']. Available since 2.0.46.yii\web\Request
$preferredLanguage read-onlystringThe language that the application should use.yii\web\Request
$psr7RequestPsr\Http\Message\ServerRequestInterfaceAttached request.Request
$queryParamsarrayThe request GET parameter values.yii\web\Request
$queryString read-onlystringPart of the request URL that is after the question mark.yii\web\Request
$rawBodystringThe request body.yii\web\Request
$referrer read-onlystring|nullURL referrer, null if not available.yii\web\Request
$remoteHost read-onlystring|nullRemote host name, null if not available.yii\web\Request
$remoteIP read-onlystring|nullRemote IP address, null if not available.yii\web\Request
$scriptFilestringThe entry script file path.yii\web\Request
$scriptUrlstringThe relative URL of the entry script.yii\web\Request
$secureHeadersarrayLists of headers that are, by default, subject to the trusted host configuration. Default: ['X-Forwarded-For', 'X-Forwarded-Host', 'X-Forwarded-Proto', 'X-Forwarded-Port', 'Front-End-Https', 'X-Rewrite-Url', 'X-Original-Host']. Available since 2.0.13.yii\web\Request
$securePortintPort number for secure requests.yii\web\Request
$secureProtocolHeadersarrayList of headers to check for determining whether the connection is made via HTTPS. Default: ['X-Forwarded-Proto' => ['https'], 'Front-End-Https' => ['on']]. Available since 2.0.13.yii\web\Request
$serverName read-onlystring|nullServer name, null if not available.yii\web\Request
$serverParams read-onlymixed[]Server parameters for the current request.Request
$serverPort read-onlyint|nullServer port number, null if not available.yii\web\Request
$trustedHostsarrayThe configuration for trusted security related headers. Default: []. Available since 2.0.13.yii\web\Request
$uploadedFiles read-onlymixed[]Nested bridge uploaded files.Request
$urlstringThe currently requested relative URL.yii\web\Request
$userAgent read-onlystring|nullUser agent, null if not available.yii\web\Request
$userHost read-onlystring|nullUser host name, null if not available.yii\web\Request
$userIP read-onlystring|nullUser IP address, null if not available.yii\web\Request
$validateCsrfHeaderOnlyboolWhether to use custom header only to CSRF validation of SPA. Default: false.yii\web\Request
MethodDescriptionDefined by
__construct()Constructor.yii\base\BaseObject
__call()Calls the named method which is not a class method.yii\base\Component
__clone()This method is called after the object is created by cloning an existing one.yii\base\Component
__get()Returns the value of a component property.yii\base\Component
__isset()Checks if a property is set, i.e. defined and not null.yii\base\Component
__set()Sets the value of a component property.yii\base\Component
__unset()Sets a component property to be null.yii\base\Component
attachBehavior()Attaches a behavior to this component.yii\base\Component
attachBehaviors()Attaches a list of behaviors to the component.yii\base\Component
behaviors()Returns a list of behaviors that this component should behave as.yii\base\Component
canGetProperty()Returns a value indicating whether a property can be read.yii\base\Component
canSetProperty()Returns a value indicating whether a property can be set.yii\base\Component
className() staticReturns the fully qualified name of this class.yii\base\BaseObject
detachBehavior()Detaches a behavior from the component.yii\base\Component
detachBehaviors()Detaches all behaviors from the component.yii\base\Component
ensureBehaviors()Makes sure that the behaviors declared in behaviors() are attached to this component.yii\base\Component
get()Returns GET parameter with a given name. If name isn’t specified, returns an array of all GET parameters.yii\web\Request
getAbsoluteUrl()Returns the currently requested absolute URL.yii\web\Request
getAcceptableContentTypes()Returns the content types acceptable by the end user.yii\web\Request
getAcceptableLanguages()Returns the languages acceptable by the end user.yii\web\Request
getAuthCredentials()Returns Basic credentials from the current Authorization header or current server parameters.Request
getAuthPassword()yii\web\Request
getAuthUser()yii\web\Request
getBaseUrl()Returns the relative URL for the application.yii\web\Request
getBehavior()Returns the named behavior object.yii\base\Component
getBehaviors()Returns all behaviors attached to this component.yii\base\Component
getBodyParam()Returns the named request body parameter value.yii\web\Request
getBodyParams()Returns parsed body parameters with a non-null configured method override removed from array bodies.Request
getContentType()Returns the current Content-Type header, falling back to Yii when no PSR request is attached.Request
getCookies()Returns a read-only collection of current PSR cookies, or Yii’s cookies without an attached request.Request
getCsrfToken()Returns the token used to perform CSRF validation.yii\web\Request
getCsrfTokenFromHeader()Retrieves the CSRF token from the request headers.Request
getETags()Gets the Etags.yii\web\Request
getHeaders()Retrieves HTTP headers from the current request, supporting PSR-7 and Yii fallback.Request
getHostInfo()Returns the schema and host part of the current request URL.yii\web\Request
getHostName()Returns the host part of the current request URL.yii\web\Request
getIsAjax()Returns whether this is an AJAX (XMLHttpRequest) request.yii\web\Request
getIsConsoleRequest()Returns a value indicating whether the current request is made via command line.yii\base\Request
getIsDelete()Returns whether this is a DELETE request.yii\web\Request
getIsFlash()Returns whether this is an Adobe Flash or Flex request.yii\web\Request
getIsGet()Returns whether this is a GET request.yii\web\Request
getIsHead()Returns whether this is a HEAD request.yii\web\Request
getIsOptions()Returns whether this is an OPTIONS request.yii\web\Request
getIsPatch()Returns whether this is a PATCH request.yii\web\Request
getIsPjax()Returns whether this is a PJAX request.yii\web\Request
getIsPost()Returns whether this is a POST request.yii\web\Request
getIsPut()Returns whether this is a PUT request.yii\web\Request
getIsSecureConnection()Resolves direct transport and trusted proxy headers from the attached request.Request
getMethod()Retrieves the HTTP method for the current request, supporting PSR-7 and Yii fallback.Request
getOrigin()Returns the URL origin of a CORS request.yii\web\Request
getParsedBody()Returns the PSR parsed body, or normalized Yii body parameters without an attached request.Request
getPathInfo()Returns the path info of the currently requested URL.yii\web\Request
getPort()Returns the port to use for insecure requests.yii\web\Request
getPreferredLanguage()Returns the user-preferred language that should be used by this application.yii\web\Request
getPsr7Request()Returns the attached PSR request, including any body parsing performed during binding.Request
getQueryParam()Returns the named GET parameter value.yii\web\Request
getQueryParams()Returns resolved Yii query parameters when non-empty, otherwise the attached PSR query parameters.Request
getQueryString()Retrieves the query string from the current request, supporting PSR-7 and Yii fallback.Request
getRawBody()Retrieves the raw body content from the current request, supporting PSR-7 and Yii fallback.Request
getReferrer()Returns the URL referrer.yii\web\Request
getRemoteHost()Retrieves the remote host name for the current request, supporting PSR-7 and Yii fallback.Request
getRemoteIP()Retrieves the remote IP address for the current request, supporting PSR-7 and Yii fallback.Request
getScriptFile()Returns the entry script file path.yii\web\Request
getScriptUrl()Returns the request script URL.Request
getSecurePort()Returns the port to use for secure requests.yii\web\Request
getServerName()Retrieves the server name for the current request, supporting PSR-7 and Yii fallback.Request
getServerParam()Retrieves a server parameter by name from the current request, supporting PSR-7 and Yii fallback.Request
getServerParams()Retrieves server parameters from the current request, supporting PSR-7 and Yii fallback.Request
getServerPort()Retrieves the server port number for the current request, supporting PSR-7 and Yii fallback.Request
getUploadedFiles()Converts attached PSR upload trees to bridge uploaded-file objects, preserving keys and nesting.Request
getUrl()Retrieves the URL of the current request, supporting PSR-7 and Yii fallback.Request
getUserAgent()Returns the user agent.yii\web\Request
getUserHost()Returns the user host name.yii\web\Request
getUserIP()Returns the user IP address.yii\web\Request
hasEventHandlers()Returns a value indicating whether there is any handler attached to the named event.yii\base\Component
hasMethod()Returns a value indicating whether a method is defined.yii\base\Component
hasProperty()Returns a value indicating whether a property is defined for this component.yii\base\Component
init()Initializes the object.yii\base\BaseObject
off()Detaches an existing event handler from this component.yii\base\Component
on()Attaches an event handler to an event.yii\base\Component
parseAcceptHeader()Parses the given Accept (or Accept-Language) header.yii\web\Request
post()Returns POST parameter with a given name. If name isn’t specified, returns an array of all POST parameters.yii\web\Request
resolve()Resolves the route with Yii’s URL manager and merges route parameters over PSR query parameters.Request
setAcceptableContentTypes()Sets the acceptable content types.yii\web\Request
setAcceptableLanguages()yii\web\Request
setBaseUrl()Sets the relative URL for the application.yii\web\Request
setBodyParams()Honors Yii body overrides without mutating the immutable PSR request.Request
setHostInfo()Sets the schema and host part of the application URL.yii\web\Request
setIsConsoleRequest()Sets the value indicating whether the current request is made via command line.yii\base\Request
setPathInfo()Sets the path info of the current request.yii\web\Request
setPort()Sets the port to use for insecure requests.yii\web\Request
setPsr7Request()Binds a PSR request, resets resolved query parameters, and registers its upload adapter.Request
setQueryParams()Sets the request $queryString parameters.yii\web\Request
setRawBody()Sets the raw HTTP request body, this method is mainly used by test scripts to simulate raw HTTP requests.yii\web\Request
setScriptFile()Sets the entry script file path.yii\web\Request
setScriptUrl()Preserves an explicitly configured entry script URL when a PSR request is attached.Request
setSecurePort()Sets the port to use for secure requests.yii\web\Request
setUrl()Sets the currently requested relative URL.yii\web\Request
trigger()Triggers an event.yii\base\Component
validateCsrfToken()Performs the CSRF validation.yii\web\Request
createCsrfCookie() protectedCreates a cookie with a randomly generated CSRF token.yii\web\Request
filterHeaders() protectedFilters headers according to the $trustedHosts.yii\web\Request
generateCsrfToken() protectedGenerates an unmasked random token used to perform CSRF validation.yii\web\Request
getIpValidator() protectedCreates instance of IpValidator.yii\web\Request
getSecureForwardedHeaderParts() protectedReturns decoded forwarded headeryii\web\Request
getSecureForwardedHeaderTrustedPart() protectedGets first Forwarded header value for tokenyii\web\Request
getSecureForwardedHeaderTrustedParts() protectedGets only trusted Forwarded header partsyii\web\Request
getTrustedHeaders() protectedTrusted headers according to the $trustedHosts.yii\web\Request
getUserIpFromIpHeader() protectedReturn user IP’s from IP header.yii\web\Request
getUserIpFromIpHeaders() protectedReturns the user IP address from $ipHeaders.yii\web\Request
loadCookies() protectedConverts $_COOKIE into an array of Cookie.yii\web\Request
loadCsrfToken() protectedLoads the CSRF token from cookie or session.yii\web\Request
resolvePathInfo() protectedResolves the path info part of the currently requested URL.yii\web\Request
resolveRequestUri() protectedResolves the request URI portion for the currently requested URL.yii\web\Request
ConstantValueDescriptionDefined by
CSRF_HEADER'X-CSRF-Token'Default name of the HTTP header for sending CSRF token.yii\web\Request
public string $cookieValidationKey = ''

A secret key used for cookie validation.

This property must be set if $enableCookieValidation is true.

public function getAuthCredentials(): array{0: string|null, 1: string|null}

Returns Basic credentials from the current Authorization header or current server parameters.

When a PSR request is attached, fallback uses its PHP_AUTH_USER and PHP_AUTH_PW only, not worker globals. Malformed Basic encoding or invalid UTF-8 yields [null, null].

Returns

array{0: string|null, 1: string|null}: Username and password.

public function getBodyParams(): mixed[]|object

Returns parsed body parameters with a non-null configured method override removed from array bodies.

Returns

mixed[]|object: Body parameters; absent or discarded scalar bodies become [].

Throws

public function getContentType(): string

Returns the current Content-Type header, falling back to Yii when no PSR request is attached.

Returns

string: Header value, or an empty string when absent.

public function getCookies(): yii\web\CookieCollection

Returns a read-only collection of current PSR cookies, or Yii’s cookies without an attached request.

Validated PSR cookies must contain a valid Yii signature and matching encoded cookie name.

Returns

yii\web\CookieCollection: Current request cookies.

Throws

public function getCsrfTokenFromHeader(): string|null

Retrieves the CSRF token from the request headers.

This method uses getHeaders() to access the header collection and retrieves the value for csrfHeader.

Returns

string|null: CSRF token value from the request header, or null if not present.

public function getHeaders(): yii\web\HeaderCollection

Retrieves HTTP headers from the current request, supporting PSR-7 and Yii fallback.

Returns a HeaderCollection containing all HTTP headers extracted from the PSR-7 ServerRequestInterface if the adapter is set.

Returns

yii\web\HeaderCollection: Collection of HTTP headers for the current request.

public function getIsSecureConnection(): bool

Resolves direct transport and trusted proxy headers from the attached request.

Returns

bool

public function getMethod(): string

Retrieves the HTTP method for the current request, supporting PSR-7 and Yii fallback.

Returns

string: Resolved HTTP method for the current request.

public function getParsedBody(): mixed[]|object|null

Returns the PSR parsed body, or normalized Yii body parameters without an attached request.

Returns

mixed[]|object|null: Parsed body; absent or discarded scalar bodies yield null.

Throws

public function getPsr7Request(): Psr\Http\Message\ServerRequestInterface

Returns the attached PSR request, including any body parsing performed during binding.

Call setPsr7Request() first; this method does not create a request from Yii globals.

Returns

Psr\Http\Message\ServerRequestInterface: Attached request.

Throws

public function getQueryParams(): mixed[]

Returns resolved Yii query parameters when non-empty, otherwise the attached PSR query parameters.

Without an attached request, delegates to Yii. Binding a replacement request clears resolved parameters.

Returns

mixed[]: Current query parameters.

public function getQueryString(): string

Retrieves the query string from the current request, supporting PSR-7 and Yii fallback.

Returns

string: Query string for the current request.

public function getRawBody(): string

Retrieves the raw body content from the current request, supporting PSR-7 and Yii fallback.

Returns

string: Raw body content for the current request.

public function getRemoteHost(): string|null

Retrieves the remote host name for the current request, supporting PSR-7 and Yii fallback.

Returns

string|null: Remote host name for the current request, or null if not available.

public function getRemoteIP(): string|null

Retrieves the remote IP address for the current request, supporting PSR-7 and Yii fallback.

Returns

string|null: Remote IP address for the current request, or null if not available or invalid.

public function getScriptUrl(): string

Returns the request script URL.

Returns

string: Script URL for the current request.

Throws

public function getServerName(): string|null

Retrieves the server name for the current request, supporting PSR-7 and Yii fallback.

Returns

string|null: Server name for the current request, or null if not available.

public function getServerParam(string $name, mixed $default = null): mixed

Retrieves a server parameter by name from the current request, supporting PSR-7 and Yii fallback.

Parameters

ParameterTypeDescription
$namestringName of the server parameter to retrieve.
$defaultmixedDefault value to return if the parameter is not set.

Returns

mixed: Value of the server parameter, or the default value if not set.

public function getServerParams(): mixed[]

Retrieves server parameters from the current request, supporting PSR-7 and Yii fallback.

Returns

mixed[]: Server parameters for the current request.

public function getServerPort(): int|null

Retrieves the server port number for the current request, supporting PSR-7 and Yii fallback.

Returns

int|null: Server port number, or null if unavailable.

public function getUploadedFiles(): mixed[]

Converts attached PSR upload trees to bridge uploaded-file objects, preserving keys and nesting.

Successful conversion detaches each PSR upload stream for Yii resource access. Failed uploads retain their error without accessing a stream. Returns [] when no PSR request is attached; it does not read $_FILES.

Returns

mixed[]: Nested bridge uploaded files.

public function getUrl(): string

Retrieves the URL of the current request, supporting PSR-7 and Yii fallback.

Returns

string: URL of the current request.

Throws

public function resolve(): mixed[]

Resolves the route with Yii’s URL manager and merges route parameters over PSR query parameters.

Without an attached request, delegates to Yii’s route resolution.

Returns

mixed[]: Route and merged parameters as a two-element array.

Throws

public function setBodyParams(mixed $values): mixed

Honors Yii body overrides without mutating the immutable PSR request.

Parameters

ParameterTypeDescription
$valuesmixedBody override, or null to resume the attached request body.

Returns

mixed

public function setPsr7Request(Psr\Http\Message\ServerRequestInterface $request): void

Binds a PSR request, resets resolved query parameters, and registers its upload adapter.

Use a fresh Request for each HTTP request: inherited Yii proxy-resolution caches are not reset by rebinding. Parses unparsed bodies with configured parsers or the urlencoded fallback. Scalar parser results are discarded. Existing non-null parsed bodies, including [], are preserved.

Parameters

ParameterTypeDescription
$requestPsr\Http\Message\ServerRequestInterfaceRequest to bind.

Throws

public function setScriptUrl(string|null $value): mixed

Preserves an explicitly configured entry script URL when a PSR request is attached.

Parameters

ParameterTypeDescription
$valuestring|nullScript URL, or null to restore automatic resolution.

Returns

mixed