HTTP request
The HTTP server passes Request as the second onMessage argument. It lazily parses one message and is not a PSR-7 ServerRequest. Start with the executable server recipe.
| Method | Behavior |
|---|---|
get($name = null, $default = null) | Query field or complete array, parsed using parse_str |
post($name = null, $default = null) | URL-encoded form, JSON array/object or multipart fields; unsupported media types yield an empty array |
input($name, $default = null) | GET takes precedence over POST |
all(), only($keys), except($keys) | GET + POST union; GET wins duplicate names |
json($name = null, $default = null) | JSON value or field; parsing failure returns null, not HTTP 400 |
setGet($data), setPost($data) | Replace parsed input |
For required JSON, decode rawBody() with JSON_THROW_ON_ERROR and validate the schema separately. Valid JSON null and a parsing failure are indistinguishable through json(). Removing NUL from form/query values does not replace validation, SQL parameters or context-specific HTML escaping.
Address, headers and content
Section titled “Address, headers and content”method()/isMethod(), protocolVersion(), uri(), path() and queryString() describe the request line. url() and fullUrl() return //host/path, without a scheme; the latter includes the query. host(true) removes the port. Never trust arbitrary Host values for redirect/callback URLs.
header() performs case-insensitive lookup; no name returns a lowercase-key map. Duplicate headers are joined with commas. setHeaders() replaces the map; trailer() reads normalized chunk trailers. cookie() decodes cookies. rawHead(), rawBody() and rawBuffer() return raw message sections.
isAjax(), isPjax(), isJson(), isHTML(), acceptJson()/acceptsJson(), expectsJson(), acceptsAnyContentType() and parseAcceptHeader() support representation selection. Client hints do not authorize access.
Connection and reverse proxies
Section titled “Connection and reverse proxies”getConnection() requires an attached connection and otherwise throws. getLocalIp/Port() and getRemoteIp/Port() describe transport endpoints. getRequestIp() and isSecure() accept forwarding headers only from Request::$trustedProxies (IP/CIDR; wildcard trusts everyone). Trust actual proxies only and sanitize incoming forwarding headers at the edge; avoid wildcard trust on an Internet-facing server.
Uploads and lifetime
Section titled “Uploads and lifetime”file($name = null) returns arrays containing name, tmp_name, size, error, type, not UploadedFile objects. Multipart uses temporary files and Request::$maxFileUploads. Client MIME is untrusted: validate size, content, allowed extensions and destination. Move retained files before Request destruction: destroy() removes remaining temporary uploads. Do not retain Request in worker-global state.
See sessions and the declaration index. The index describes signatures, not all protocol decoder behavior.