Http Laravel Package

This release hardens the reverse-proxy trust model: the real client address, scheme and host are now resolved correctly from multi-hop Forwarded and X-Forwarded-* headers, and you can choose which of them your proxy is allowed to speak for. On top of that, CLI scripts finally get a meaningful request URL.

💥 Breaking Changes

• Applications configured through the DI extension now trust only X-Forwarded-* headers from a trusted proxy by default, so a client-supplied Forwarded header can no longer spoof the address or host. If your proxy uses the Forwarded header, set http: proxyHeaders: forwarded (or both).
• getRemoteAddress() returns null instead of a non-IP string when the innermost forwarded value is not a valid IP address (e.g. an obfuscated identifier or a broken chain).

✨ New Features

• proxyHeaders option (both|xForwarded|forwarded|none) and the $forwarded / $xForwarded flags of RequestFactory::setProxy() let you tell Nette exactly which forwarding headers your proxy manages – and ignore the rest.
• RequestFactory::setBaseUrl() and the http: baseUrl option give CLI runs (cron, tasks, MCP servers) a real request URL, so %baseUrl%, LinkGenerator, template $baseUrl and assets work outside the web server too. It kicks in only when no host can be detected, so web requests are unaffected.

🐛 Bug Fixes

• Trusted-proxy resolution now parses Forwarded into proper RFC 7239 hops and picks the client by stripping trailing trusted proxies, instead of blindly trusting the leftmost, client-spoofable value; scheme and host are taken from the same hop as the selected address and no longer discarded on multi-hop headers.
• Response::setCookie() treats an explicitly empty $path or $domain as given: '' now yields a host-only cookie or the / path instead of silently falling back to the configured defaults. Only null means "not specified".

This release brings serious firepower to server-side HTTP handling. The headline is a brand-new SSRF defense kit – IPAddress and UrlValidator let you validate URLs and pin connections before your app ever talks to an attacker-controlled host. On top of that, cookie handling gets a modern overhaul with a type-safe SameSite enum, CHIPS/Partitioned support, and a proper Max-Age attribute, while the new Request::isFrom() gives you reliable same-site request detection – even on Safari. Now on PHP 8.3.

Changes

• PHP 8.3 is now required. Time to upgrade your runtime if you haven't already.
• UserStorage is gone – the long-deprecated class has been removed. Use the standard authentication storage instead.
• Request::getRemoteHost() is deprecated and now returns null – reverse DNS lookups were slow, unreliable, and a privacy footgun. Resolve the hostname yourself from getRemoteAddress() if you really need it (#218).

Deprecations (still working, but plan ahead)

• The IResponse::SameSite* constants are deprecated in favor of the new SameSite enum.
• Request::isSameSite() is deprecated – use isFrom() instead.
• Passing integer 0 as the expiration to Response::setCookie() is deprecated – use null for a session cookie.

✨ New Features

• SSRF protection, batteries included – the new IPAddress is an immutable IPv4/IPv6 value object with rich predicates (isPublic(), isPrivate(), isLoopback(), isLinkLocal(), isMulticast(), isReserved()), CIDR matching via isInRange(), and IPv4-mapped IPv6 normalization. Pair it with UrlValidator, a configurable guard that vets scheme, port, host allow/blocklists, userinfo, and – optionally with DNS – the resolved IP ranges. It even hands back the resolved IPs so you can pin the connection through CURLOPT_RESOLVE and defeat DNS-rebinding.
• Request::isFrom() – a single, reliable way to check where a request came from, with site, dest, and user parameters built on the Sec-Fetch-* headers. For browsers without Sec-Fetch support (Safari < 16.4), it transparently falls back to a strict cookie, so same-site detection just works everywhere.
• Type-safe SameSite enum – setCookie() and Session now accept a proper enum instead of magic strings, so typos become compile-time problems, not silent security holes.
• Response::setCookie() speaks modern cookie – it now supports the Partitioned attribute (CHIPS) for third-party cookies, emits a Max-Age attribute (which takes precedence over expires and ignores the client clock), and forces Secure automatically when SameSite=None, sparing you a browser rejection.
• Helpers::expirationToSeconds() – one consistent parser for every expiration value across the library. Numbers are relative seconds, while DateTimeInterface and textual strings like '20 minutes' or '2024-01-01' resolve as absolute times; each caller decides what null means in its own context.
• Helpers::parseQualityList() – parses HTTP quality-value lists (Accept, Accept-Language, …) into a ranked token map. Request::detectLanguage() was rewritten on top of it and is more correct as a result.

• RequestFactory::setForceHttps() – force the request scheme to HTTPS regardless of the server environment, handy behind proxies and load balancers that don't advertise TLS termination. Also exposed via the DI config option http: forceHttps: true.
• Request::getOrigin() now strictly follows RFC 6454 – returns null for any Origin header that isn't a bare scheme://host[:port] (e.g. headers containing a path are rejected instead of being silently accepted).
• Improved phpDoc types and descriptions across the whole Nette\Http namespace – better IDE autocompletion and PHPStan inference for Request, Response, Session, Url and friends.

• support for PHP 8.5
• optimized global function calls
• Url, UrlImmutable: user & password are deprecated

• UrlImmutable, UrlScript: added resolve()
• Url: added isAbsolute() & removeDotSegments()
• UrlImmutable, UrlScript: removed build() method
• Url::canonicalize() char " does not need to be encoded
• Url, UrlImmutable: user & password are deprecated
• FileUpload::__construct() accepts path
• SessionPanel: convert templates to Latte-like syntax

• support for PHP 8.4
• FileUpload::getSanitizedName() changes the extension only for image files #239
• RequestFactory: extract port from x-forwarded-host (#230)
• FileUpload: Initialize properties (#235)(#195)
• Session: keep exceptions chain on session_start (#240)
• Session: SessionSection class template annotation #225
• IResponse: added DateTimeInterface to setCookie $expire param (#237)
• readonly properties

• FileUpload: added getSuggestedExtension()
• RequestFactory: unify and fix host parsing (#229)

• requires PHP 8.1
• uses PHP 8.1 features

• support for PHP 8.3
• FileUpload: detects supported images
• RequestFactory: fixed port detection when HTTP_HOST & SERVER_PORT are used #223
• removed fix for IE

• SessionExtension: don't set readAndClose if null (#213)
• Improved https recognition behind load balancer (#221)
• RequestFactory: fix X-Forwarded-Host mixup with remote host (#222)
• RequestFactory: performance optimization #220
• RequestFactory: fixed filter detection
• Url: host can end with dot #198
• added Session::getSectionNames(), replacement for getIterator()

• SessionExtension: don't set readAndClose if null (#213)
• Improved https recognition behind load balancer (#221)
• RequestFactory: fix X-Forwarded-Host mixup with remote host (#222)
• RequestFactory: performance optimization
• RequestFactory: fixed filter detection
• Url: host can end with dot #198

BC break:

• RequestFactory: removed HTTP authentication credential from Url to prevent leak it (#211 #215)

$httpRequest->getUrl()->getUser() + getPassword()
// changed to 
[$user, $pass] = $httpRequest->getBasicCredentials();

New features:

• Request: added getBasicCredentials()
• Url, UrlImmutable: added getDefaultPort()
• RequestFactory::getHeaders() recreates Authorization header
• support for full_path upload (#207 #212)
• HttpExtension: dynamic options cookiePath, cookieDomain, cookieSecure (#216)
• constants are PascalCase

Deprecations:

• IRequest::getRemoteHost() is silently deprecated (#218)
• SessionSection: magic accessors & ArrayAccess are silently deprecated
• Session::getIterator() is deprecated

• support for PHP 8.2
• Request::getReferer() is deprecated #210
• cs

• added Request::getOrigin()
• RequestFactory: support for PHP built-in web server nette-examples/user-authentication#3
• coding style

• SessionExtension: added values 'always' & 'never' for option 'autoStart'
• Session: option 'autoStart' controls auto start on reading or writing (BC break)
• Session: added autoStart() to prevent session files from being created when the session id is spoofed
• SessionSection: remove() is not writing operation
• SessionSection: added methods set(), get(), remove()
• Session: refactoring
• Session: cleaning is done in __destruct
• Session: don't send session cookie twice
• Session: don't regenerate ID in readAndClose mode
• Session: added events $onStart & $onBeforeWrite
• Session: fixed condition in clean()

• SessionExtension: default is autoStart = false to avoid creating new session files if the session_id is spoofed (BC break)
• SessionSection: added methods set(), get(), remove()
• Session: don't send session cookie twice
• Session: don't regenerate ID in readAndClose mode
• Session: fixed condition in clean()

• support for PHP 8.1
• HttpExtension: added option 'disableNetteCookie' #205
• Session: fixed option 'readAndClose' #206
• Session: fixed condition in destroy() (#204)
• RequestFactory: urlFilters replaces only double // to single
• RequestFactory: strips trailing . from host

• HttpExtension: added option 'disableNetteCookie' #205
• Session: fixed option 'readAndClose' #206
• Session: fixed condition in destroy() (#204)
• RequestFactory: urlFilters replaces only double // to single
• RequestFactory: strips trailing . from host
• Helpers: nette-samesite is resent at each request
• IResponse: added constants SAME_SITE_*
• ScriptUrl: Fix class extendability (#187) (#188)

• added Response::sendAsFile()
• SessionSection: __get() returns reference (#191)(#192)
• Url: IDN domain automatically convert to UTF-8. (#190)

For the details you can have a look at the diff.

• requires PHP 7.2
• Response::setCookie() default $sameSite is 'Lax' (BC break)
• Response::setCookie() prevents an inappropriate combination of path and domain
• Response: deprecated $cookieHttpOnly
• Request::getFile() accepts array of keys and returns FileUpload|null (BC break)
• FileUpload::getImageSize() returns only [x, y] values (BC break)
• UrlImmutable: added withQueryParameter()
• Url: silently deprecated getBasePath(), getBaseUrl(), getRelativeUrl()
• UserStorage is deprecated by Nette\Bridges\SecurityHttp\SessionStorage

Session & Cookies

• Session: default sameSite is 'Lax' (BC break)
• SessionExtension: option session.cookieSecure is deprecated, http.cookieSecure is used (BC break)
• SessionExtension: checks that cookieSamesite is Lax|Strict|None (BC break)
• SessionSection: can read data when session is closed
• Session: deprecated getCookieParameters() triggers E_USER_DEPRECATED
• HttpExtension: added options cookiePath & cookieDomain
• HttpExtension: cookieSecure is by default 'auto' (BC break)
• cookie nette-samesite renamed to _nss

compatible with PHP 8.0

• compatible with PHP 8.0
• FileUpload: added getImageFileExtension()
• FileUpload: added getUntrustedName() as alias for getName()
• FileUpload::getSanitizedName: returns correct file extension for images
• FileUpload: fixed TypeError if getimagesize() returns false (#184)
• FileUpload::getSanitizedName: Remove redundant minus before dot. (#179)
• FileUpload::getSanitizedName: returns 'unknown' instead of empty string
• Helpers::initCookie() sends cookie nette-samesite only if doesn't exist

For the details you can have a look at the diff.

• Url::parseQuery() fixed parsing of ; #177
• RequestFactory: $xForwardedForWithoutProxies can be empty #175
• SessionPanel: uses capturing
• HttpExtension, SessionExtension: uses $initialization (requires nette/di 3.0.3)
• uses nette/utils 3.1

For the details you can have a look at the diff.

• HttpExtension: added support for 'http:' in CSP
• Session: prevents warning Cannot change session cookie parameters when session is active
• Url::parseQuery() accepts separator ;
• IResponse: added REASON_PHRASES
• HttpExtension: 'proxy' can be string

For the details you can have a look at the diff.

• Session: added read_and_close configuration (#156)
• RequestFactory: respect host set by trusted proxy (#162)
• RequestFactory: set user and password to Url (#161)
• UrlImmutable: added withoutUserInfo()
• Url, UrlImmutable: includes "empty" hostname ('0') in the host URL (#159)(#158)
• added .phpstorm.meta.php

For the details you can have a look at the diff.

• DI extensions: are using configuration Schema
• simplified code
• Session: do not regenerate session ID when is newly created
• Session: security options can not be bypassed
• Session: $started changed from static to object property
• Session: $started replaced with checking session_status() for better cooperation with the session started outside nette nette/forms#214
• RequestFactory: added workaround [] in REMOTE_ADDR #152
• Revert "HttpExtension: uses interfaces IRequest & IResponse instead of Request & Response (BC break) #90"
• SessionExtension: accepts 'cookieSamesite = true'
• Revert "Session: by default uses sameSite: Lax (BC break)"
• HttpExtension: removed option 'sameSiteProtection', cookie 'nette-samesite' is always set
• Session: validates configuration option names
• SessionPanel: uses Tracy\Helpers::escapeHtml()

For the details you can have a look at the diff.

• Session: do not regenerate session ID when is newly created
• HttpExtension: option 'sameSiteProtection' does not change session cookie flag 'samesite'
• SessionExtension: added option handler to pass own SessionHandlerInterface (#146)

For the details you can have a look at the diff.

Features

• requires PHP 7.1
• uses declare(strict_types=1)
• uses PHP 7.1 scalar and return type hints
• added support for SameSite cookie
• Request, HttpExtension: added sameSite protection (enabled by default)
• Session: by default uses sameSite: Lax (BC break)
• Session: enabled PHP option use_strict_mode
• FileUpload: added IMAGE_MIME_TYPES
• FileUpload: Added Webp content type to isImage (#132)
• added UrlImmutable
• UrlScript: added getRelativePath() [Closes #45]

Changes

• UrlScript extends from UrlImmutable (BC break)
• Request: removed unused second parameter $query (BC break)
• IRequest, IResponse, Url: parameters $default are deprecated (BC break)
• HttpExtension: uses interfaces IRequest & IResponse instead of Request & Response (BC break) [Closes #90]
• some classes & members marked as final (BC break)
• HttpExtension: default value of secureCookie is auto (BC break)
• Session: default values for cookie_path, cookie_domain & cookie_secure are taken from Response
• Session::getCookieParameters() is deprecated
• Url::parseQuery() - correctly decodes spaces and dots in keys (BC break)
• Url: is not ignoring user & password (BC break) [Closes #63]
• RequestFactory: removed user & password from Url (BC break)
• Request::getReferer() returns UrlImmutable (BC break)

• Request, HttpExtension: added sameSite protection
• Session: added support for SameSite cookie
• Response::setCookie() supports SameSite
• SessionExtension: cookieSecure can be 'auto'
• Response: removed removeDuplicateCookies() #139
• HttpExtension: added option cookieSecure; allowed values are: true, false, auto
• HttpExtension: allows bools in CSP policy
• HttpExtension: fixed quotating in sections require-sri-for & sandbox #143
• HttpExtension: added Feature-Policy header #142
• HttpExtension: renamed csp-report to cspReportOnly (BC break)
• fixed compatibility with PHP 7.3

For the details you can have a look at the diff.

• SessionPanel: compatibility with Tracy 2.5
• coding style
• type fixes

For the details you can have a look at the diff.

• HttpExtension: allow setup CSP in restrictive and report mode at the same time #136 #135
• Session: don't call session_set_cookie_params() when values was not changed #134 #23
• Session: session id cookie is checked only if it was not regenerated #133 #129

For the details you can have a look at the diff.

• supports PHP up to 7.2
• FileUpload: uses FileSystem
• silenced each() deprecation notice in PHP 7.2

For the details you can have a look at the diff.

• coding style: fixes, lowercase true/false/null
• RequestFactory: when proxy is used and HTTP_X_FORWARDED_PORT is not available, uses default port #124
• RequestFactory: test that HTTP_X_FORWARDED_PROTO doesn't change the port
• typo
• RequestFactory: correctly ignores not-ip values in HTTP_X_FORWARDED_FOR & REMOTE_ADDR (#122)

For the details you can have a look at the diff.