Http Laravel Package

Product Decisions This Supports

• Build vs. buy on SSRF defense. IPAddress + UrlValidator (v3.4.0) cover CIDR matching, public/private/loopback/link-local predicates, scheme/port/host allow-blocklists, and DNS-resolved IP ranges with the resolved IPs handed back for CURLOPT_RESOLVE pinning. Any roadmap item that fetches user-supplied URLs — webhook delivery, avatar/image import, link previews, RSS/feed ingestion, "test connection" buttons — can ship without our team hand-rolling that logic. This is the single strongest justification for adoption.
• Security roadmap prioritization. Cookie hardening (type-safe SameSite enum, Partitioned/CHIPS, Max-Age, auto-Secure on SameSite=None) and correct multi-hop Forwarded/X-Forwarded-* resolution are recurring audit findings and pen-test line items. Buying them converts a multi-sprint hardening track into a dependency bump.
• Compliance and browser-deprecation readiness. Third-party cookie deprecation and Safari's inconsistent Sec-Fetch support are product-visible risks for embedded/iframe and multi-domain experiences. Request::isFrom() with its strict-cookie fallback is a defensible answer to "does same-site detection work on Safari?" in a design review.
• Scope decisions on our HTTP edge. Choosing this package means we deliberately don't build our own request/response/session/URL primitives. That frees engineering capacity for differentiated work and constrains the blast radius of a future framework or runtime migration — provided we consume it behind our own adapters.
• Operational surface for non-web processes. RequestFactory::setBaseUrl() / http: baseUrl gives CLI runs (cron, queue workers, scheduled jobs, internal MCP-style services) a real request URL, so %baseUrl%, link generators, template variables, and asset URLs work identically outside the web server. This directly affects the quality of links in transactional email and notifications generated from queue jobs.
• Deployment architecture decisions. The proxyHeaders option (both|xForwarded|forwarded|none) plus setForceHttps() lets us state an explicit trust contract per environment — useful when deciding whether to terminate TLS at the LB, add another proxy hop, or run behind a CDN. That is an infra/PM decision, not just a code one.
• Risk register input. Not every capability here is a product feature; some are "known footguns we no longer own" (reverse DNS on getRemoteHost(), obfuscated proxy identifiers returning null instead of a fake IP, Origin header parsed strictly per RFC 6454).

When to Consider This Package

Adopt when:

• The runtime is PHP 8.3+ and we are willing to take a Nette-namespaced API as a leaf dependency.
• We need SSRF validation with connection pinning as a first-class, tested capability — this is the clearest ROI and the least overlap with what Laravel ships.
• We have a real reverse-proxy topology (multi-hop Forwarded, LB → ingress → app) and want a defensible trust model instead of TrustProxies guesswork.
• We need modern cookie serialization — CHIPS/Partitioned, explicit empty path/domain semantics, Max-Age precedence — for embedded or third-party-context surfaces.
• We want CLI-safe base URLs so links generated from queue/cron jobs are not broken.
• We treat it as a scoped utility dependency wrapped in our own interfaces, so it never leaks into domain code.

Look elsewhere when:

• We are greenfield on Laravel. Illuminate\Http\Request/Response, Symfony HttpFoundation, Illuminate\Support\Uri/league/uri, and Laravel's session layer already cover the baseline request/response/session/URL surface. Adopting this for those is duplicated surface area with no first-class Laravel integration — no service provider, no container bindings, no published config.
• We need framework-integrated, maintainer-blessed components. This is a Nette ecosystem package (489 stars, no meaningful dependent signal in this index); the support model is "good docs + steady releases," not vendor SLAs.
• License clarity is a blocker. The NOASSERTION identifier must be resolved to a reviewed, compatible license before any procurement or legal sign-off. Do not let this sit in an architecture doc as "probably BSD."
• We would be replacing broad framework primitives rather than filling narrow gaps — the cost/benefit inverts fast.
• We cannot absorb minor-version behavior changes: v3.4.1 flips the DI default for trusted proxy headers (a client-supplied Forwarded header can no longer spoof address/host) and changes getRemoteAddress() to return null. v3.4.0 removed UserStorage, deprecated Request::isSameSite(), deprecated integer 0 cookie expiry, and deprecated getRemoteHost(). These are improvements, but they are upgrade work someone must own.
• The release timestamp warrants a sanity check. The latest release is dated 2026-10-23; confirm the actual cadence and channel before committing to a version floor.

Adoption gate: run a two-day spike that (a) wraps UrlValidator/IPAddress behind our own outbound-URL interface, (b) proves proxyHeaders behavior in a staging topology with the real proxy chain, and (c) resolves the license. If all three pass, scope it to SSRF + proxy trust + cookie serialization only.

How to Pitch It (Stakeholders)

For executives — one paragraph. nette/http is a small, mature PHP library that gives us three things we would otherwise build and maintain ourselves: a ready-made defense against SSRF (the class of vulnerability that lets an attacker make our servers fetch internal or cloud-metadata endpoints), correct client-IP and scheme resolution behind multiple proxy hops, and modern cookie attributes including the ones browsers now require for embedded contexts. It is a focused security-hardening dependency, not a framework change. We recommend adopting it narrowly — for outbound-URL validation, trusted-proxy resolution, and cookie serialization — while keeping it behind our own interfaces so it can be swapped out. Two caveats we are owning explicitly: the license identifier is unasserted and must be cleared before adoption, and the package is not a first-class Laravel citizen, so we absorb the integration ourselves. Net effect: meaningful reduction in security and compliance risk for roughly a sprint of integration and a small, permanent maintenance line — with the bulk of the value landing on attack surface we already expose today.

For engineering — the short version. Treat it as a leaf dependency, never a framework. Highest-value pieces: IPAddress + UrlValidator (allowlist, CIDR, resolved-IP pinning via CURLOPT_RESOLVE to defeat DNS rebinding), RequestFactory::setProxy() with proxyHeaders for a declared multi-hop trust contract, SameSite enum + Partitioned/Max-Age in setCookie(), Request::isFrom() for same-site checks, and setBaseUrl() for queue/cron link generation. Requirements: PHP 8.3+, our own adapter interfaces, a staging test of the real proxy chain, and an upgrade owner for the DI-default and null-return changes introduced in 3.4.1. Do not adopt it for request/response/session/URL primitives we already get from Laravel and Symfony — that is duplicated surface with no integration support.