Weave Code
Http Laravel Package
nette/http
Nette HTTP is a lightweight PHP library for handling HTTP requests and responses. It provides clean APIs for headers, cookies, sessions, URL parsing, file uploads, and response output, making it easy to build robust web applications and services.
🌐 Abstraction for HTTP request, response and session. Provides careful data sanitization and utility for URL and cookies manipulation.
Frequently asked questions about Http
- Can I use Nette HTTP in Laravel 10+ to replace Illuminate\Http\Request for stricter security?
- Yes, but with custom integration. Nette HTTP’s immutable `Request` and `UrlValidator` can augment Laravel’s request handling (e.g., SSRF protection via `UrlValidator`). You’ll need to wrap it in a Laravel service provider or middleware to bridge the gap with Laravel’s `Illuminate\Http\Request`. Start with `RequestFactory` to create Nette requests from Laravel’s `Request` object.
- How do I enforce SameSite cookies in Laravel using Nette HTTP?
- Use `Response::setCookie()` with Nette’s `SameSite` enum (e.g., `SameSite::Strict`). The method auto-enforces `Secure` flag for `SameSite=None`, reducing manual configuration. Example: `$response->setCookie(new Cookie('token', 'value', ['sameSite' => SameSite::Lax]))`. Works seamlessly with Laravel’s session drivers like Redis or database.
- Will Nette HTTP break my Laravel 9 app if I upgrade to PHP 8.3?
- No, but you’ll need to drop Nette HTTP v4.x (PHP 8.3+) and use v3.3.x (supports PHP 8.1–8.5). Laravel 9 runs on PHP 8.1+, so v3.3.x is compatible. However, test thoroughly—some features (e.g., `UrlImmutable`) require PHP 8.3. Check the [upgrade guide](https://github.com/nette/http#upgrading) for deprecated methods like `Request::getRemoteHost()`.
- How can I validate outbound URLs (e.g., redirects, API calls) in Laravel with Nette HTTP?
- Create a Laravel middleware using `UrlValidator`. Example: `new UrlValidator(['allow' => ['https://trusted.com']])->validate($request->url)`. Abort invalid requests with `abort(400)`. This replaces manual regex checks and adds SSRF protection. Integrate it in `app/Http/Kernel.php` under the `web` or `api` middleware group.
- Does Nette HTTP support Laravel’s session drivers (Redis, database) for partitioned cookies?
- Yes, but indirectly. Nette’s `Session` class works with Laravel’s session drivers if you bind it via a service provider. For partitioned cookies (e.g., `SameSite=None`), use `Session::setPartitioned(true)` and configure Laravel’s session driver (e.g., `SESSION_DRIVER=redis` in `.env`). Nette’s `SessionExtension` can help manage session lifecycle (e.g., `readAndClose()`).
- Can I use Nette HTTP’s `FileUpload` to sanitize file uploads in Laravel Forms?
- Absolutely. Replace `Illuminate\Http\UploadedFile` with `FileUpload` for stricter validation. Example: `$file = new FileUpload($_FILES['file']); $file->getSanitizedName()` removes unsafe characters. Use `getMimeType()` or `validateImage()` for MIME/type checks. Bind it in a Form Request or middleware for global upload sanitization.
- What’s the performance impact of using Nette HTTP in a high-traffic Laravel app?
- Minimal. Nette HTTP is optimized for low overhead—immutable objects (e.g., `UrlImmutable`) reduce memory churn, and lazy-loaded features (e.g., `Request::getOrigin()`) avoid unnecessary parsing. Benchmark against Laravel’s native `Request`/`Response`, but expect comparable or better performance for security-heavy operations like URL validation or cookie serialization.
- Are there alternatives to Nette HTTP for Laravel that offer similar security features?
- Yes, but with trade-offs. Laravel’s built-in `Illuminate\Http` covers basics (CSRF, validation), but lacks Nette’s granular controls (e.g., `UrlValidator` for SSRF, `SameSite` enums). For URL parsing, consider `symfony/psr-http-message` (PSR-7 compliant) or `league/uri` (simpler but less secure). Nette HTTP stands out for its PHP 8.3+ security-first design and immutability.
- How do I test Nette HTTP in Laravel’s PHPUnit tests without mocking the entire HTTP layer?
- Use `RequestFactory` to create mock requests. Example: `$request = (new RequestFactory())->createRequest(['url' => 'https://test.com']); $validator = new UrlValidator(['allow' => ['https://test.com']]); $validator->validate($request->url)`. Test `Response` by asserting cookie headers: `$response = new Response(); $response->setCookie(new Cookie('test', 'value')); $this->assertStringContainsString('Set-Cookie', $response->getHeader('Set-Cookie'))`.
- What’s the best way to integrate Nette HTTP with Laravel’s middleware pipeline?
- Wrap Nette components in Laravel middleware. Example for URL validation: `public function handle($request, Closure $next) { $validator = new UrlValidator(['allow' => ['https://api.example.com']]); if (!$validator->validate($request->url)) { return response('Invalid URL', 403); } return $next($request); }`. Register it in `app/Http/Kernel.php` under the `web` or `api` middleware group. For sessions, bind `Nette\Http\Session` to Laravel’s session driver via a service provider.
Weaver
How can I help you explore Laravel packages today?