Class yii\web\Request

Creates a cookie with a randomly generated CSRF token.

Initial values specified in $csrfCookie will be applied to the generated cookie.

See also $enableCsrfValidation.

Filters headers according to the $trustedHosts.

Generates an unmasked random token used to perform CSRF validation.

Returns GET parameter with a given name. If name isn't specified, returns an array of all GET parameters.

Returns the currently requested absolute URL.

This is a shortcut to the concatenation of $hostInfo and $url.

Returns the content types acceptable by the end user.

This is determined by the Accept HTTP header. For example,

$_SERVER['HTTP_ACCEPT'] = 'text/plain; q=0.5, application/json; version=1.0, application/xml; version=2.0;';
$types = $request->getAcceptableContentTypes();
print_r($types);
// displays:
// [
//     'application/json' => ['q' => 1, 'version' => '1.0'],
//      'application/xml' => ['q' => 1, 'version' => '2.0'],
//           'text/plain' => ['q' => 0.5],
// ]

Returns the languages acceptable by the end user.

This is determined by the Accept-Language HTTP header.

See also:

• getAuthUser() to get only username.
• getAuthPassword() to get only password.

See also getAuthCredentials() to get both username and password in one call.

See also getAuthCredentials() to get both username and password in one call.

Returns the relative URL for the application.

This is similar to $scriptUrl except that it does not include the script file name, and the ending slashes are removed.

See also setScriptUrl().

Returns the named request body parameter value.

If the parameter does not exist, the second parameter passed to this method will be returned.

See also:

• getBodyParams()
• setBodyParams()

Returns the request parameters given in the request body.

Request parameters are determined using the parsers configured in $parsers property. If no parsers are configured for the current $contentType it uses the PHP function mb_parse_str() to parse the request body.

See also:

• getMethod()
• getBodyParam()
• setBodyParams()

Returns request content-type The Content-Type header field indicates the MIME type of the data contained in getRawBody() or, in the case of the HEAD method, the media type that would have been sent had the request been a GET.

For the MIME-types the user expects in response, see $acceptableContentTypes.

Returns the cookie collection.

Through the returned cookie collection, you may access a cookie using the following syntax:

$cookie = $request->cookies['name']
if ($cookie !== null) {
    $value = $cookie->value;
}

// alternatively
$value = $request->cookies->getValue('name');

Returns the token used to perform CSRF validation.

This token is generated in a way to prevent BREACH attacks. It may be passed along via a hidden field of an HTML form or an HTTP header value to support CSRF validation.

Gets the Etags.

Returns the header collection.

The header collection contains incoming HTTP headers.

Returns the schema and host part of the current request URL.

The returned URL does not have an ending slash.

By default this value is based on the user request information. This method will return the value of $_SERVER['HTTP_HOST'] if it is available or $_SERVER['SERVER_NAME'] if not. You may want to check out the PHP documentation for more information on these variables.

You may explicitly specify it by setting the hostInfo property.

Warning: Dependent on the server configuration this information may not be reliable and may be faked by the user sending the HTTP request. If the webserver is configured to serve the same site independent of the value of the Host header, this value is not reliable. In such situations you should either fix your webserver configuration or explicitly set the value by setting the hostInfo property. If you don't have access to the server configuration, you can setup yii\filters\HostControl filter at application level in order to protect against such kind of attack.

See also setHostInfo().

Returns the host part of the current request URL.

Value is calculated from current hostInfo property.

Warning: The content of this value may not be reliable, dependent on the server configuration. Please refer to getHostInfo() for more information.

See also getHostInfo().

Creates instance of yii\validators\IpValidator.

You can override this method to adjust validator or implement different matching strategy.

Returns whether this is an AJAX (XMLHttpRequest) request.

Note that in case of cross domain requests, browser doesn't set the X-Requested-With header by default: https://stackoverflow.com/questions/8163703/cross-domain-ajax-doesnt-send-x-requested-with-header

In case you are using fetch(), pass header manually:

fetch(url, {
   method: 'GET',
   headers: {'X-Requested-With': 'XMLHttpRequest'}
})

Returns whether this is a DELETE request.

Returns whether this is an Adobe Flash or Flex request.

Returns whether this is a GET request.

Returns whether this is a HEAD request.

Returns whether this is an OPTIONS request.

Returns whether this is a PATCH request.

Returns whether this is a PJAX request.

Returns whether this is a POST request.

Returns whether this is a PUT request.

Return if the request is sent via secure channel (https).

Returns the method of the current request (e.g. GET, POST, HEAD, PUT, PATCH, DELETE).

Returns the URL origin of a CORS request.

The return value is taken from the Origin header sent by the browser.

Note that the origin request header indicates where a fetch originates from. It doesn't include any path information, but only the server name. It is sent with a CORS requests, as well as with POST requests. It is similar to the referer header, but, unlike this header, it doesn't disclose the whole path. Please refer to https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Origin for more information.

See also getHeaders().

Returns the path info of the currently requested URL.

A path info refers to the part that is after the entry script and before the question mark (query string). The starting and ending slashes are both removed.

Returns the port to use for insecure requests.

Defaults to 80, or the port specified by the server if the current request is insecure.

See also setPort().

Returns the user-preferred language that should be used by this application.

The language resolution is based on the user preferred languages and the languages supported by the application. The method will try to find the best match.

Returns the named GET parameter value.

If the GET parameter does not exist, the second parameter passed to this method will be returned.

See also getBodyParam().

Returns the request parameters given in the $queryString.

This method will return the contents of $_GET if params where not explicitly set.

See also setQueryParams().

Returns part of the request URL that is after the question mark.

Returns the raw HTTP request body.

Returns the URL referrer.

Returns the host name of the other end of this connection.

This is always the next hop, any headers are ignored.

See also:

• getUserHost()
• getRemoteIP()

Returns the IP on the other end of this connection.

This is always the next hop, any headers are ignored.

Returns the entry script file path.

The default implementation will simply return $_SERVER['SCRIPT_FILENAME'].

Returns the relative URL of the entry script.

The implementation of this method referenced Zend_Controller_Request_Http in Zend Framework.

Returns decoded forwarded header

Gets first Forwarded header value for token

Gets only trusted Forwarded header parts

Returns the port to use for secure requests.

Defaults to 443, or the port specified by the server if the current request is secure.

See also setSecurePort().

Returns the server name.

Returns the server port number.

Trusted headers according to the $trustedHosts.

Returns the currently requested relative URL.

This refers to the portion of the URL that is after the $hostInfo part. It includes the $queryString part if any.

Returns the user agent.

Returns the user host name.

The HOST is determined using headers and / or $_SERVER variables.

Returns the user IP address.

The IP is determined using headers and / or $_SERVER variables.

Return user IP's from IP header.

See also:

• getUserHost()
• $ipHeaders
• getTrustedHeaders()

Returns the user IP address from $ipHeaders.

See also $ipHeaders.

Converts $_COOKIE into an array of yii\web\Cookie.

Loads the CSRF token from cookie or session.

Parses the given Accept (or Accept-Language) header.

This method will return the acceptable values with their quality scores and the corresponding parameters as specified in the given Accept header. The array keys of the return value are the acceptable values, while the array values consisting of the corresponding quality scores and parameters. The acceptable values with the highest quality scores will be returned first. For example,

$header = 'text/plain; q=0.5, application/json; version=1.0, application/xml; version=2.0;';
$accepts = $request->parseAcceptHeader($header);
print_r($accepts);
// displays:
// [
//     'application/json' => ['q' => 1, 'version' => '1.0'],
//      'application/xml' => ['q' => 1, 'version' => '2.0'],
//           'text/plain' => ['q' => 0.5],
// ]

Returns POST parameter with a given name. If name isn't specified, returns an array of all POST parameters.

Resolves the current request into a route and the associated parameters.

Resolves the path info part of the currently requested URL.

A path info refers to the part that is after the entry script and before the question mark (query string). The starting slashes are both removed (ending slashes will be kept).

Resolves the request URI portion for the currently requested URL.

This refers to the portion that is after the $hostInfo part. It includes the $queryString part if any. The implementation of this method referenced Zend_Controller_Request_Http in Zend Framework.

Sets the acceptable content types.

Please refer to getAcceptableContentTypes() on the format of the parameter.

See also:

• getAcceptableContentTypes()
• parseAcceptHeader()

Sets the relative URL for the application.

By default the URL is determined based on the entry script URL. This setter is provided in case you want to change this behavior.

Sets the request body parameters.

See also:

• getBodyParam()
• getBodyParams()

Sets the schema and host part of the application URL.

This setter is provided in case the schema and hostname cannot be determined on certain Web servers.

See also getHostInfo() for security related notes on this property.

Sets the path info of the current request.

This method is mainly provided for testing purpose.

Sets the port to use for insecure requests.

This setter is provided in case a custom port is necessary for certain server configurations.

Sets the request $queryString parameters.

See also:

• getQueryParam()
• getQueryParams()

Sets the raw HTTP request body, this method is mainly used by test scripts to simulate raw HTTP requests.

Sets the entry script file path.

The entry script file path normally can be obtained from $_SERVER['SCRIPT_FILENAME']. If your server configuration does not return the correct value, you may configure this property to make it right.

Sets the relative URL for the application entry script.

This setter is provided in case the entry script URL cannot be determined on certain Web servers.

Sets the port to use for secure requests.

This setter is provided in case a custom port is necessary for certain server configurations.

Sets the currently requested relative URL.

The URI must refer to the portion that is after $hostInfo. Note that the URI should be URL-encoded.

Performs the CSRF validation.

This method will validate the user-provided CSRF token by comparing it with the one stored in cookie or session. This method is mainly called in yii\web\Controller::beforeAction().

Note that the method will NOT perform CSRF validation if $enableCsrfValidation is false or the HTTP method is among GET, HEAD or OPTIONS.