$ show nette/http
nette/http is a standalone PHP library providing HTTP abstraction for request/response handling, URL manipulation, session management, and file uploads. It is part of the Nette Framework ecosystem but is usable independently. The library offers immutable `Request` and `UrlImmutable` objects for safe processing, alongside mutable `Response` and `Session` for stateful operations. It includes security-focused features such as input sanitization, CSRF protection via `Sec-Fetch-*` headers (with fallback), SSRF protection via `UrlValidator` and `IPAddress`, and a proxy trust model for client IP resolution behind reverse proxies. The codebase is well-structured, with clear separation of concerns, comprehensive test coverage (Nette Tester), and strict static analysis (PHPStan level 8). It requires PHP 8.3-8.5 and depends on `nette/utils`. The repository is actively maintained with recent commits, CI on multiple OSes, and an issue tracker.
The LLM identified 6 files worth highlighting for reuse:
Immutable IPv4/IPv6 address value object with class predicates (isPrivate, isLoopback, isPublic) and CIDR matching via isInRange(). Normalizes IPv4-mapped IPv6 so ::ffff:127.0.0.1 evaluates as loopback. Standalone and fully reusable for any project handling IP ranges, logging, or SSRF prevention.
Configurable SSRF-protection validator that checks scheme, port, host allow/blocklist, userinfo policy, and resolved IP range membership. calls allows() resolves DNS and validates every A/AAAA record; getResolvedIPs() returns validated IPs for connection pinning (e.g., CURLOPT_RESOLVE). Readonly policy object, no HTTP client dependency.
Mutable URL representation with setters/getters for all components. Parses string URLs, provides normalization (canonicalize, IDN conversion), query manipulation, and string serialization. The only class that parses URLs; UrlImmutable and UrlScript delegate to it. Reusable pattern for any URL construction or parsing task.
Immutable URL with withers (withScheme, withHost, etc.) that return new instances. Implements RFC 3986 relative URL resolution via resolve(). Caches authority string. Useful for safe URL manipulation where immutability is required, e.g., representing request URLs in immutable request objects.
Wraps an uploaded file with methods for safe access: getSanitizedName() produces ASCII-safe name with correct extension for images, getContentType() uses fileinfo on actual file (ignores client-supplied type), isImage() checks signature. Reusable for any PHP project needing robust file upload handling without assuming client data is safe.
Extends UrlImmutable with scriptPath, basePath, pathInfo, relativeUrl computed from two stored fields (scriptPath, basePath). Used by Request to represent the application's entry point. Demonstrates how to derive multiple virtual URL components from a few authoritative values. Reusable for any framework needing base-URL awareness.