Request
API reference › PSR bridge › http › Request
Extends Yii request handling with PSR-7 request data.
ServerRequestAdapter PSR-7 to Yii request adapter.
Properties
Section titled “Properties”| Property | Type | Description | Defined by |
|---|---|---|---|
$absoluteUrl read-only | string | The currently requested absolute URL. | yii\ |
$acceptableContentTypes | array | The content types ordered by the quality score. | yii\ |
$acceptableLanguages | array | The languages ordered by the preference level. | yii\ |
$authCredentials read-only | array | That contains exactly two elements: - 0: the username sent via HTTP authentication, null if the username is not given - 1: the password sent via HTTP authentication, null if the password is not given. | yii\ |
$authPassword read-only | string| | The password sent via HTTP authentication, null if the password is not given. | yii\ |
$authUser read-only | string| | The username sent via HTTP authentication, null if the username is not given. | yii\ |
$baseUrl | string | The relative URL for the application. | yii\ |
$behaviors read-only | array<yii\<static>> | List of behaviors attached to this component. | yii\ |
$bodyParams | mixed | The request parameters given in the request body. | yii\ |
$contentType read-only | string | Request content-type. | yii\ |
$cookies read-only | yii\ | The cookie collection. | yii\ |
$cookieValidationKey | string | A secret key used for cookie validation. Default: ''. | Request |
$csrfCookie | array | The configuration for creating the CSRF cookie. Default: ['httpOnly' => true]. | yii\ |
$csrfHeader | string | The name of the HTTP header for sending CSRF token. Default: self::CSRF_HEADER. | yii\ |
$csrfHeaderUnsafeMethods | array | “unsafe” methods not triggered a CORS-preflight request This property is used only when both $enableCsrfValidation and $validateCsrfHeaderOnly are true. Default: ['GET',. | yii\ |
$csrfParam | string | The name of the token used to prevent CSRF. Default: '_csrf'. | yii\ |
$csrfToken read-only | null| | The token used to perform CSRF validation. | yii\ |
$csrfTokenFromHeader read-only | string| | The CSRF token sent via $csrfHeader by browser. | yii\ |
$csrfTokenSafeMethods | array | The name of the HTTP header for sending CSRF token. by default validate CSRF token on non-”safe” methods only This property is used only when $enableCsrfValidation is true. Default: ['GET',. | yii\ |
$enableCookieValidation | bool | Whether cookies should be validated to ensure they are not tampered. Default: true. | yii\ |
$enableCsrfCookie | bool | Whether to use cookie to persist CSRF token. Default: true. | yii\ |
$enableCsrfValidation | bool | Whether to enable CSRF (Cross-Site Request Forgery) validation. Default: true. | yii\ |
$eTags read-only | array | The entity tags. | yii\ |
$headers read-only | yii\ | The header collection. | yii\ |
$hostInfo | string| | Schema and hostname part (with port number if needed) of the request URL (e.g. https://www.yiiframework.com), null if can’t be obtained from $_SERVER and wasn’t set. | yii\ |
$hostName read-only | string| | Hostname part of the request URL (e.g. www.yiiframework.com). | yii\ |
$ipHeaders | string[] | List of headers where proxies store the real client IP. Default: ['X-Forwarded-For']. Available since 2.0.13. | yii\ |
$isAjax read-only | bool | Whether this is an AJAX (XMLHttpRequest) request. | yii\ |
$isConsoleRequest | bool | The value indicating whether the current request is made via console. | yii\ |
$isDelete read-only | bool | Whether this is a DELETE request. | yii\ |
$isFlash read-only | bool | Whether this is an Adobe Flash or Adobe Flex request. | yii\ |
$isGet read-only | bool | Whether this is a GET request. | yii\ |
$isHead read-only | bool | Whether this is a HEAD request. | yii\ |
$isOptions read-only | bool | Whether this is a OPTIONS request. | yii\ |
$isPatch read-only | bool | Whether this is a PATCH request. | yii\ |
$isPjax read-only | bool | Whether this is a PJAX request. | yii\ |
$isPost read-only | bool | Whether this is a POST request. | yii\ |
$isPut read-only | bool | Whether this is a PUT request. | yii\ |
$isSecureConnection read-only | bool | If the request is sent via secure channel (https). | yii\ |
$method read-only | string | Request method, such as GET, POST, HEAD, PUT, PATCH, DELETE. | yii\ |
$methodParam | string | The name of the POST parameter that is used to indicate if a request is a PUT, PATCH or DELETE request tunneled through POST. Default: '_method'. | yii\ |
$origin read-only | string| | URL origin of a CORS request, null if not available. | yii\ |
$parsedBody read-only | mixed[]| | Parsed body; absent or discarded scalar bodies yield null. | Request |
$parsers | array<string, | Parser definitions keyed by Content-Type. | Request |
$pathInfo | string | Part of the request URL that is after the entry script and before the question mark. | yii\ |
$port | int | Port number for insecure requests. | yii\ |
$portHeaders | string[] | List of headers where proxies store the real request port. Default: ['X-Forwarded-Port']. Available since 2.0.46. | yii\ |
$preferredLanguage read-only | string | The language that the application should use. | yii\ |
$psr7Request | Psr\ | Attached request. | Request |
$queryParams | array | The request GET parameter values. | yii\ |
$queryString read-only | string | Part of the request URL that is after the question mark. | yii\ |
$rawBody | string | The request body. | yii\ |
$referrer read-only | string| | URL referrer, null if not available. | yii\ |
$remoteHost read-only | string| | Remote host name, null if not available. | yii\ |
$remoteIP read-only | string| | Remote IP address, null if not available. | yii\ |
$scriptFile | string | The entry script file path. | yii\ |
$scriptUrl | string | The relative URL of the entry script. | yii\ |
$secureHeaders | array | Lists of headers that are, by default, subject to the trusted host configuration. Default: ['X-Forwarded-For',. Available since 2.0.13. | yii\ |
$securePort | int | Port number for secure requests. | yii\ |
$secureProtocolHeaders | array | List of headers to check for determining whether the connection is made via HTTPS. Default: ['X-Forwarded-Proto' => ['https'],. Available since 2.0.13. | yii\ |
$serverName read-only | string| | Server name, null if not available. | yii\ |
$serverParams read-only | mixed[] | Server parameters for the current request. | Request |
$serverPort read-only | int| | Server port number, null if not available. | yii\ |
$trustedHosts | array | The configuration for trusted security related headers. Default: []. Available since 2.0.13. | yii\ |
$uploadedFiles read-only | mixed[] | Nested bridge uploaded files. | Request |
$url | string | The currently requested relative URL. | yii\ |
$userAgent read-only | string| | User agent, null if not available. | yii\ |
$userHost read-only | string| | User host name, null if not available. | yii\ |
$userIP read-only | string| | User IP address, null if not available. | yii\ |
$validateCsrfHeaderOnly | bool | Whether to use custom header only to CSRF validation of SPA. Default: false. | yii\ |
Methods
Section titled “Methods”| Method | Description | Defined by |
|---|---|---|
__construct() | Constructor. | yii\ |
__call() | Calls the named method which is not a class method. | yii\ |
__clone() | This method is called after the object is created by cloning an existing one. | yii\ |
__get() | Returns the value of a component property. | yii\ |
__isset() | Checks if a property is set, i.e. defined and not null. | yii\ |
__set() | Sets the value of a component property. | yii\ |
__unset() | Sets a component property to be null. | yii\ |
attachBehavior() | Attaches a behavior to this component. | yii\ |
attachBehaviors() | Attaches a list of behaviors to the component. | yii\ |
behaviors() | Returns a list of behaviors that this component should behave as. | yii\ |
canGetProperty() | Returns a value indicating whether a property can be read. | yii\ |
canSetProperty() | Returns a value indicating whether a property can be set. | yii\ |
className() static | Returns the fully qualified name of this class. | yii\ |
detachBehavior() | Detaches a behavior from the component. | yii\ |
detachBehaviors() | Detaches all behaviors from the component. | yii\ |
ensureBehaviors() | Makes sure that the behaviors declared in behaviors() are attached to this component. | yii\ |
get() | Returns GET parameter with a given name. If name isn’t specified, returns an array of all GET parameters. | yii\ |
getAbsoluteUrl() | Returns the currently requested absolute URL. | yii\ |
getAcceptableContentTypes() | Returns the content types acceptable by the end user. | yii\ |
getAcceptableLanguages() | Returns the languages acceptable by the end user. | yii\ |
getAuthCredentials() | Returns Basic credentials from the current Authorization header or current server parameters. | Request |
getAuthPassword() | yii\ | |
getAuthUser() | yii\ | |
getBaseUrl() | Returns the relative URL for the application. | yii\ |
getBehavior() | Returns the named behavior object. | yii\ |
getBehaviors() | Returns all behaviors attached to this component. | yii\ |
getBodyParam() | Returns the named request body parameter value. | yii\ |
getBodyParams() | Returns parsed body parameters with a non-null configured method override removed from array bodies. | Request |
getContentType() | Returns the current Content-Type header, falling back to Yii when no PSR request is attached. | Request |
getCookies() | Returns a read-only collection of current PSR cookies, or Yii’s cookies without an attached request. | Request |
getCsrfToken() | Returns the token used to perform CSRF validation. | yii\ |
getCsrfTokenFromHeader() | Retrieves the CSRF token from the request headers. | Request |
getETags() | Gets the Etags. | yii\ |
getHeaders() | Retrieves HTTP headers from the current request, supporting PSR-7 and Yii fallback. | Request |
getHostInfo() | Returns the schema and host part of the current request URL. | yii\ |
getHostName() | Returns the host part of the current request URL. | yii\ |
getIsAjax() | Returns whether this is an AJAX (XMLHttpRequest) request. | yii\ |
getIsConsoleRequest() | Returns a value indicating whether the current request is made via command line. | yii\ |
getIsDelete() | Returns whether this is a DELETE request. | yii\ |
getIsFlash() | Returns whether this is an Adobe Flash or Flex request. | yii\ |
getIsGet() | Returns whether this is a GET request. | yii\ |
getIsHead() | Returns whether this is a HEAD request. | yii\ |
getIsOptions() | Returns whether this is an OPTIONS request. | yii\ |
getIsPatch() | Returns whether this is a PATCH request. | yii\ |
getIsPjax() | Returns whether this is a PJAX request. | yii\ |
getIsPost() | Returns whether this is a POST request. | yii\ |
getIsPut() | Returns whether this is a PUT request. | yii\ |
getIsSecureConnection() | Resolves direct transport and trusted proxy headers from the attached request. | Request |
getMethod() | Retrieves the HTTP method for the current request, supporting PSR-7 and Yii fallback. | Request |
getOrigin() | Returns the URL origin of a CORS request. | yii\ |
getParsedBody() | Returns the PSR parsed body, or normalized Yii body parameters without an attached request. | Request |
getPathInfo() | Returns the path info of the currently requested URL. | yii\ |
getPort() | Returns the port to use for insecure requests. | yii\ |
getPreferredLanguage() | Returns the user-preferred language that should be used by this application. | yii\ |
getPsr7Request() | Returns the attached PSR request, including any body parsing performed during binding. | Request |
getQueryParam() | Returns the named GET parameter value. | yii\ |
getQueryParams() | Returns resolved Yii query parameters when non-empty, otherwise the attached PSR query parameters. | Request |
getQueryString() | Retrieves the query string from the current request, supporting PSR-7 and Yii fallback. | Request |
getRawBody() | Retrieves the raw body content from the current request, supporting PSR-7 and Yii fallback. | Request |
getReferrer() | Returns the URL referrer. | yii\ |
getRemoteHost() | Retrieves the remote host name for the current request, supporting PSR-7 and Yii fallback. | Request |
getRemoteIP() | Retrieves the remote IP address for the current request, supporting PSR-7 and Yii fallback. | Request |
getScriptFile() | Returns the entry script file path. | yii\ |
getScriptUrl() | Returns the request script URL. | Request |
getSecurePort() | Returns the port to use for secure requests. | yii\ |
getServerName() | Retrieves the server name for the current request, supporting PSR-7 and Yii fallback. | Request |
getServerParam() | Retrieves a server parameter by name from the current request, supporting PSR-7 and Yii fallback. | Request |
getServerParams() | Retrieves server parameters from the current request, supporting PSR-7 and Yii fallback. | Request |
getServerPort() | Retrieves the server port number for the current request, supporting PSR-7 and Yii fallback. | Request |
getUploadedFiles() | Converts attached PSR upload trees to bridge uploaded-file objects, preserving keys and nesting. | Request |
getUrl() | Retrieves the URL of the current request, supporting PSR-7 and Yii fallback. | Request |
getUserAgent() | Returns the user agent. | yii\ |
getUserHost() | Returns the user host name. | yii\ |
getUserIP() | Returns the user IP address. | yii\ |
hasEventHandlers() | Returns a value indicating whether there is any handler attached to the named event. | yii\ |
hasMethod() | Returns a value indicating whether a method is defined. | yii\ |
hasProperty() | Returns a value indicating whether a property is defined for this component. | yii\ |
init() | Initializes the object. | yii\ |
off() | Detaches an existing event handler from this component. | yii\ |
on() | Attaches an event handler to an event. | yii\ |
parseAcceptHeader() | Parses the given Accept (or Accept-Language) header. | yii\ |
post() | Returns POST parameter with a given name. If name isn’t specified, returns an array of all POST parameters. | yii\ |
resolve() | Resolves the route with Yii’s URL manager and merges route parameters over PSR query parameters. | Request |
setAcceptableContentTypes() | Sets the acceptable content types. | yii\ |
setAcceptableLanguages() | yii\ | |
setBaseUrl() | Sets the relative URL for the application. | yii\ |
setBodyParams() | Honors Yii body overrides without mutating the immutable PSR request. | Request |
setHostInfo() | Sets the schema and host part of the application URL. | yii\ |
setIsConsoleRequest() | Sets the value indicating whether the current request is made via command line. | yii\ |
setPathInfo() | Sets the path info of the current request. | yii\ |
setPort() | Sets the port to use for insecure requests. | yii\ |
setPsr7Request() | Binds a PSR request, resets resolved query parameters, and registers its upload adapter. | Request |
setQueryParams() | Sets the request $queryString parameters. | yii\ |
setRawBody() | Sets the raw HTTP request body, this method is mainly used by test scripts to simulate raw HTTP requests. | yii\ |
setScriptFile() | Sets the entry script file path. | yii\ |
setScriptUrl() | Preserves an explicitly configured entry script URL when a PSR request is attached. | Request |
setSecurePort() | Sets the port to use for secure requests. | yii\ |
setUrl() | Sets the currently requested relative URL. | yii\ |
trigger() | Triggers an event. | yii\ |
validateCsrfToken() | Performs the CSRF validation. | yii\ |
createCsrfCookie() protected | Creates a cookie with a randomly generated CSRF token. | yii\ |
filterHeaders() protected | Filters headers according to the $trustedHosts. | yii\ |
generateCsrfToken() protected | Generates an unmasked random token used to perform CSRF validation. | yii\ |
getIpValidator() protected | Creates instance of IpValidator. | yii\ |
getSecureForwardedHeaderParts() protected | Returns decoded forwarded header | yii\ |
getSecureForwardedHeaderTrustedPart() protected | Gets first Forwarded header value for token | yii\ |
getSecureForwardedHeaderTrustedParts() protected | Gets only trusted Forwarded header parts | yii\ |
getTrustedHeaders() protected | Trusted headers according to the $trustedHosts. | yii\ |
getUserIpFromIpHeader() protected | Return user IP’s from IP header. | yii\ |
getUserIpFromIpHeaders() protected | Returns the user IP address from $ipHeaders. | yii\ |
loadCookies() protected | Converts $_COOKIE into an array of Cookie. | yii\ |
loadCsrfToken() protected | Loads the CSRF token from cookie or session. | yii\ |
resolvePathInfo() protected | Resolves the path info part of the currently requested URL. | yii\ |
resolveRequestUri() protected | Resolves the request URI portion for the currently requested URL. | yii\ |
Constants
Section titled “Constants”| Constant | Value | Description | Defined by |
|---|---|---|---|
CSRF_HEADER | 'X-CSRF-Token' | Default name of the HTTP header for sending CSRF token. | yii\ |
Property details
Section titled “Property details”$cookieValidationKey
Section titled “$cookieValidationKey ”public string $cookieValidationKey = ''A secret key used for cookie validation.
This property must be set if $enableCookieValidation is true.
Method details
Section titled “Method details”getAuthCredentials()
Section titled “getAuthCredentials() ”public function getAuthCredentials(): array{0: string|null, 1: string|null}Returns Basic credentials from the current Authorization header or current server parameters.
When a PSR request is attached, fallback uses its PHP_AUTH_USER and PHP_AUTH_PW only, not worker globals.
Malformed Basic encoding or invalid UTF-8 yields [null, null].
Returns
array{0: string|null, 1: string|null}: Username and password.
getBodyParams()
Section titled “getBodyParams() ”public function getBodyParams(): mixed[]|objectReturns parsed body parameters with a non-null configured method override removed from array bodies.
Returns
mixed[]|object: Body parameters; absent or discarded scalar bodies become [].
Throws
yii\base\InvalidConfigException: when a fallback Yii parser definition is invalid.
getContentType()
Section titled “getContentType() ”public function getContentType(): stringReturns the current Content-Type header, falling back to Yii when no PSR request is attached.
Returns
string: Header value, or an empty string when absent.
getCookies()
Section titled “getCookies() ”public function getCookies(): yii\web\CookieCollectionReturns a read-only collection of current PSR cookies, or Yii’s cookies without an attached request.
Validated PSR cookies must contain a valid Yii signature and matching encoded cookie name.
Returns
yii\web\CookieCollection: Current request cookies.
Throws
yii\base\InvalidConfigException: when cookie validation is enabled without a key.
getCsrfTokenFromHeader()
Section titled “getCsrfTokenFromHeader() ”public function getCsrfTokenFromHeader(): string|nullRetrieves the CSRF token from the request headers.
This method uses getHeaders() to access the header collection and retrieves the value for
csrfHeader.
Returns
string|null: CSRF token value from the request header, or null if not present.
getHeaders()
Section titled “getHeaders() ”public function getHeaders(): yii\web\HeaderCollectionRetrieves HTTP headers from the current request, supporting PSR-7 and Yii fallback.
Returns a HeaderCollection containing all HTTP headers extracted from the PSR-7 ServerRequestInterface if
the adapter is set.
Returns
yii\web\HeaderCollection: Collection of HTTP headers for the current request.
getIsSecureConnection()
Section titled “getIsSecureConnection() ”public function getIsSecureConnection(): boolResolves direct transport and trusted proxy headers from the attached request.
Returns
bool
getMethod()
Section titled “getMethod() ”public function getMethod(): stringRetrieves the HTTP method for the current request, supporting PSR-7 and Yii fallback.
Returns
string: Resolved HTTP method for the current request.
getParsedBody()
Section titled “getParsedBody() ”public function getParsedBody(): mixed[]|object|nullReturns the PSR parsed body, or normalized Yii body parameters without an attached request.
Returns
mixed[]|object|null: Parsed body; absent or discarded scalar bodies yield null.
Throws
yii\base\InvalidConfigException: when a fallback Yii parser definition is invalid.
getPsr7Request()
Section titled “getPsr7Request() ”public function getPsr7Request(): Psr\Http\Message\ServerRequestInterfaceReturns the attached PSR request, including any body parsing performed during binding.
Call setPsr7Request() first; this method does not create a request from Yii globals.
Returns
Psr\Http\Message\ServerRequestInterface: Attached request.
Throws
yii\base\InvalidConfigException: when no PSR request has been attached.
getQueryParams()
Section titled “getQueryParams() ”public function getQueryParams(): mixed[]Returns resolved Yii query parameters when non-empty, otherwise the attached PSR query parameters.
Without an attached request, delegates to Yii. Binding a replacement request clears resolved parameters.
Returns
mixed[]: Current query parameters.
getQueryString()
Section titled “getQueryString() ”public function getQueryString(): stringRetrieves the query string from the current request, supporting PSR-7 and Yii fallback.
Returns
string: Query string for the current request.
getRawBody()
Section titled “getRawBody() ”public function getRawBody(): stringRetrieves the raw body content from the current request, supporting PSR-7 and Yii fallback.
Returns
string: Raw body content for the current request.
getRemoteHost()
Section titled “getRemoteHost() ”public function getRemoteHost(): string|nullRetrieves the remote host name for the current request, supporting PSR-7 and Yii fallback.
Returns
string|null: Remote host name for the current request, or null if not available.
getRemoteIP()
Section titled “getRemoteIP() ”public function getRemoteIP(): string|nullRetrieves the remote IP address for the current request, supporting PSR-7 and Yii fallback.
Returns
string|null: Remote IP address for the current request, or null if not available or invalid.
getScriptUrl()
Section titled “getScriptUrl() ”public function getScriptUrl(): stringReturns the request script URL.
Returns
string: Script URL for the current request.
Throws
yii\base\InvalidConfigException: if unable to determine the entry script URL.
getServerName()
Section titled “getServerName() ”public function getServerName(): string|nullRetrieves the server name for the current request, supporting PSR-7 and Yii fallback.
Returns
string|null: Server name for the current request, or null if not available.
getServerParam()
Section titled “getServerParam() ”public function getServerParam(string $name, mixed $default = null): mixedRetrieves a server parameter by name from the current request, supporting PSR-7 and Yii fallback.
Parameters
| Parameter | Type | Description |
|---|---|---|
$name | string | Name of the server parameter to retrieve. |
$default | mixed | Default value to return if the parameter is not set. |
Returns
mixed: Value of the server parameter, or the default value if not set.
getServerParams()
Section titled “getServerParams() ”public function getServerParams(): mixed[]Retrieves server parameters from the current request, supporting PSR-7 and Yii fallback.
Returns
mixed[]: Server parameters for the current request.
getServerPort()
Section titled “getServerPort() ”public function getServerPort(): int|nullRetrieves the server port number for the current request, supporting PSR-7 and Yii fallback.
Returns
int|null: Server port number, or null if unavailable.
getUploadedFiles()
Section titled “getUploadedFiles() ”public function getUploadedFiles(): mixed[]Converts attached PSR upload trees to bridge uploaded-file objects, preserving keys and nesting.
Successful conversion detaches each PSR upload stream for Yii resource access. Failed uploads retain their
error without accessing a stream. Returns [] when no PSR request is attached; it does not read $_FILES.
Returns
mixed[]: Nested bridge uploaded files.
getUrl()
Section titled “getUrl() ”public function getUrl(): stringRetrieves the URL of the current request, supporting PSR-7 and Yii fallback.
Returns
string: URL of the current request.
Throws
yii\base\InvalidConfigException: if the configuration is invalid or incomplete.
resolve()
Section titled “resolve() ”public function resolve(): mixed[]Resolves the route with Yii’s URL manager and merges route parameters over PSR query parameters.
Without an attached request, delegates to Yii’s route resolution.
Returns
mixed[]: Route and merged parameters as a two-element array.
Throws
yii\web\NotFoundHttpException: when the URL manager cannot resolve the request.
setBodyParams()
Section titled “setBodyParams() ”public function setBodyParams(mixed $values): mixedHonors Yii body overrides without mutating the immutable PSR request.
Parameters
| Parameter | Type | Description |
|---|---|---|
$values | mixed | Body override, or null to resume the attached request body. |
Returns
mixed
setPsr7Request()
Section titled “setPsr7Request() ”public function setPsr7Request(Psr\Http\Message\ServerRequestInterface $request): voidBinds a PSR request, resets resolved query parameters, and registers its upload adapter.
Use a fresh Request for each HTTP request: inherited Yii proxy-resolution caches are not reset by rebinding.
Parses unparsed bodies with configured parsers or the urlencoded fallback. Scalar parser
results are discarded. Existing non-null parsed bodies, including [], are preserved.
Parameters
| Parameter | Type | Description |
|---|---|---|
$request | Psr\ | Request to bind. |
Throws
yii\base\InvalidConfigException: when a configured parser does not implement Yii’s request parser contract.
setScriptUrl()
Section titled “setScriptUrl() ”public function setScriptUrl(string|null $value): mixedPreserves an explicitly configured entry script URL when a PSR request is attached.
Parameters
| Parameter | Type | Description |
|---|---|---|
$value | string| | Script URL, or null to restore automatic resolution. |
Returns
mixed