Weave Code
Http Laravel Package
nette/http
Nette HTTP is a lightweight PHP library for handling HTTP requests and responses. It provides clean APIs for headers, cookies, sessions, URL parsing, file uploads, and response output, making it easy to build robust web applications and services.
🌐 Abstraction for HTTP request, response and session. Provides careful data sanitization and utility for URL and cookies manipulation.
Frequently asked questions about Http
- What is nette/http used for in a Laravel application?
- Nette HTTP is a standalone PHP library for abstracting HTTP requests, responses, cookies, sessions, URL parsing, and file uploads. In Laravel, it is most useful as a security-focused helper layer for URL validation, cookie hardening, sanitized uploads, and advanced session control rather than as a direct replacement for Laravel's HTTP layer. You typically wrap it in services, middleware, or custom adapters.
- How do I install nette/http with Composer?
- Run composer require nette/http in your Laravel project. Check your PHP version first because the current release requires PHP 8.3 or newer. For PHP 8.1-8.2, use the v3.3.x line; for PHP 7.4-8.0, v2.4.x is available but lacks modern features.
- Does nette/http support Laravel 10 and PHP 8.3?
- The current nette/http release supports PHP 8.3+ and can be used alongside Laravel 10+ on compatible PHP versions. Laravel 10 itself supports PHP 8.1+, so projects on PHP 8.1 or 8.2 should pin nette/http v3.3.x instead of the latest release. Laravel 9 and older are a hard stop for current versions.
- How do I integrate nette/http with Laravel's Request and Response?
- There is no native Laravel service provider, facade, or middleware in nette/http, so you add custom glue code. Bind Nette\Http\IRequest or related classes in a service provider and adapt Laravel's Illuminate\Http\Request data into Nette's RequestFactory where needed. For responses, use Nette's cookie and header APIs as helpers or harden Laravel's own response objects.
- Can nette/http replace Laravel's Illuminate\Http\Request?
- Not directly. Laravel's request and response classes are tightly coupled to routing, middleware, validation, and the framework's container, while nette/http provides independent HTTP abstractions. You can use nette/http selectively for URL parsing, SSRF checks, cookie handling, or upload sanitization without replacing Laravel's request lifecycle. Replacing Illuminate\Http\Request wholesale would require significant custom integration.
- How does nette/http improve cookie security in Laravel?
- Nette HTTP provides type-safe SameSite handling via an enum, Partitioned cookie support, and automatic Secure enforcement when SameSite=None is used. These features can harden Laravel's cookie layer, especially for third-party analytics or cross-site scenarios. You can use the library's cookie utilities alongside Laravel's response cookies rather than replacing them.
- How do I use nette/http UrlValidator to prevent SSRF in Laravel?
- Wrap UrlValidator in Laravel middleware or a dedicated outbound HTTP client guard, configuring allow lists strictly for trusted hosts and schemes. For example, validate redirect or API target URLs before dispatching requests, and abort with a 400 when validation fails. Test edge cases carefully because misconfiguration can cause false positives or false negatives.
- Is nette/http compatible with Laravel session drivers like Redis?
- Nette HTTP's session layer can complement Laravel session drivers such as Redis or database sessions, especially for fine-grained controls like readAndClose, autoStart, and Partitioned cookies. It does not natively plug into Laravel's session manager, so you need custom integration if you want to use Nette's session features. For most apps, use it as an augmentation rather than a replacement.
- What breaking changes should I check before upgrading nette/http for Laravel?
- The current version requires PHP 8.3+, and deprecations include UserStorage, Request::getRemoteHost(), getReferer(), and SessionSection magic methods. The cookie API changed to a SameSite enum, and setCookie() now auto-enforces Secure for SameSite=None. Audit custom code and third-party packages, then test your Laravel integration thoroughly.
- Are there alternatives to nette/http for Laravel HTTP handling?
- Laravel's built-in Illuminate\Http\Request and Response, Guzzle, and Symfony HttpFoundation are common alternatives for general HTTP handling. Nette HTTP stands out for security-focused features like SSRF protection, strict URL parsing, cookie hardening, and sanitized file uploads. Choose it when you need those specific utilities rather than a full Laravel HTTP replacement.
Weaver
How can I help you explore Laravel packages today?