Psr7 Laravel Package

Getting Started

Install via Composer:

composer require slim/psr7

This package provides a strict, production-ready PSR-7 implementation (implementing both MessageInterface, RequestInterface, ResponseInterface, ServerRequestInterface, UploadedFileInterface, UriInterface, and factory interfaces via Psr7Factory). Although originally built for Slim 4, it works standalone in any PSR-7-compatible framework or standalone application.

First practical use case:

use Slim\Psr7\Factory\ServerRequestFactory;

$factory = new ServerRequestFactory();
$request = $factory->createServerRequest('GET', '/api/users?limit=10');

You’ll typically use the Slim\Psr7\Factory classes (ServerRequestFactory, RequestFactory, ResponseFactory, StreamFactory, UploadedFileFactory, UriFactory) to construct PSR-7 objects programmatically (e.g., in tests or micro-frameworks), or let your framework do it automatically.

Implementation Patterns

• Testing: Use ServerRequestFactory to mock incoming requests with arbitrary headers, cookies, files, and parsed body:

  $request = (new ServerRequestFactory())->createServerRequest(
      'POST', 
      '/upload', 
      ['HTTP_CONTENT_TYPE' => 'multipart/form-data']
  )->withParsedBody(['name' => 'test'])->withUploadedFiles([...]);
  

• PSR-17 compatibility: Leverage the built-in factories to fulfill PSR-17 requirements (e.g., HttpFactoryDiscovery + Slim\Psr7\Factory\ServerRequestFactory as a fallback).
• Frame-like usage: In non-Slim apps (e.g., custom middleware stacks), manually construct responses:

  $response = (new ResponseFactory())->createResponse(201);
  $response->getBody()->write(json_encode(['id' => 123]));
  $response = $response->withHeader('Content-Type', 'application/json');
  

• Header & cookie utilities: Use Slim\Psr7\Header (internal, but safely accessible) to parse/normalize headers, or rely on Request/Response’s native getHeaderLine() / getCookieParams().

Gotchas and Tips

• PHP version: Requires ≥ PHP 8.0 (1.7.0+), but 1.4.2 supports PHP 8.4 for legacy needs. Do not use with PHP 7.x unless locked to <1.7.
• Immutable by design: All with* methods return new instances—accidentally ignoring return values is a common source of bugs.
• Cookie parsing quirks: Pre-v1.8.0 had an invalid cookie expiration format. Ensure ^1.8.0+ for RFC 6265-compliant Set-Cookie headers.
• URI normalization: Uri::getPath() now correctly strips leading slashes for relative paths (v1.4.2+). Avoid manual path concatenation.
• Security patches: CVE-2023-30536 (fixed in 1.4.1, 1.5.1, 1.6.1) requires updating if on older patch versions—always pin to latest patch.
• No external dependencies beyond polyfills, making it lightweight and predictable for high-throughput apps.
• Strictness: Unlike some PSR-7 implementations, Slim’s disallows malformed headers (e.g., headers with newlines) and validates values at construction time.
• Extension tip: Override factory behavior by extending Slim\Psr7\Factory\ServerRequestFactory (e.g., custom stream class) and injecting your own.