Released version 3.4.1

This release hardens the reverse-proxy trust model: the real client address, scheme and host are now resolved correctly from multi-hop Forwarded and X-Forwarded-* headers, and you can choose which of them your proxy is allowed to speak for. On top of that, CLI scripts finally get a meaningful request URL.

💥 Breaking Changes

• Applications configured through the DI extension now trust only X-Forwarded-* headers from a trusted proxy by default, so a client-supplied Forwarded header can no longer spoof the address or host. If your proxy uses the Forwarded header, set http: proxyHeaders: forwarded (or both).
• getRemoteAddress() returns null instead of a non-IP string when the innermost forwarded value is not a valid IP address (e.g. an obfuscated identifier or a broken chain).

✨ New Features

• proxyHeaders option (both|xForwarded|forwarded|none) and the $forwarded / $xForwarded flags of RequestFactory::setProxy() let you tell Nette exactly which forwarding headers your proxy manages – and ignore the rest.
• RequestFactory::setBaseUrl() and the http: baseUrl option give CLI runs (cron, tasks, MCP servers) a real request URL, so %baseUrl%, LinkGenerator, template $baseUrl and assets work outside the web server too. It kicks in only when no host can be detected, so web requests are unaffected.

🐛 Bug Fixes

• Trusted-proxy resolution now parses Forwarded into proper RFC 7239 hops and picks the client by stripping trailing trusted proxies, instead of blindly trusting the leftmost, client-spoofable value; scheme and host are taken from the same hop as the selected address and no longer discarded on multi-hop headers.
• Response::setCookie() treats an explicitly empty $path or $domain as given: '' now yields a host-only cookie or the / path instead of silently falling back to the configured defaults. Only null means "not specified".

Released version 3.4.0

This release brings serious firepower to server-side HTTP handling. The headline is a brand-new SSRF defense kit – IPAddress and UrlValidator let you validate URLs and pin connections before your app ever talks to an attacker-controlled host. On top of that, cookie handling gets a modern overhaul with a type-safe SameSite enum, CHIPS/Partitioned support, and a proper Max-Age attribute, while the new Request::isFrom() gives you reliable same-site request detection – even on Safari. Now on PHP 8.3.

Changes

• PHP 8.3 is now required. Time to upgrade your runtime if you haven't already.
• UserStorage is gone – the long-deprecated class has been removed. Use the standard authentication storage instead.
• Request::getRemoteHost() is deprecated and now returns null – reverse DNS lookups were slow, unreliable, and a privacy footgun. Resolve the hostname yourself from getRemoteAddress() if you really need it (#218).

Deprecations (still working, but plan ahead)

• The IResponse::SameSite* constants are deprecated in favor of the new SameSite enum.
• Request::isSameSite() is deprecated – use isFrom() instead.
• Passing integer 0 as the expiration to Response::setCookie() is deprecated – use null for a session cookie.

✨ New Features

• SSRF protection, batteries included – the new IPAddress is an immutable IPv4/IPv6 value object with rich predicates (isPublic(), isPrivate(), isLoopback(), isLinkLocal(), isMulticast(), isReserved()), CIDR matching via isInRange(), and IPv4-mapped IPv6 normalization. Pair it with UrlValidator, a configurable guard that vets scheme, port, host allow/blocklists, userinfo, and – optionally with DNS – the resolved IP ranges. It even hands back the resolved IPs so you can pin the connection through CURLOPT_RESOLVE and defeat DNS-rebinding.
• Request::isFrom() – a single, reliable way to check where a request came from, with site, dest, and user parameters built on the Sec-Fetch-* headers. For browsers without Sec-Fetch support (Safari < 16.4), it transparently falls back to a strict cookie, so same-site detection just works everywhere.
• Type-safe SameSite enum – setCookie() and Session now accept a proper enum instead of magic strings, so typos become compile-time problems, not silent security holes.
• Response::setCookie() speaks modern cookie – it now supports the Partitioned attribute (CHIPS) for third-party cookies, emits a Max-Age attribute (which takes precedence over expires and ignores the client clock), and forces Secure automatically when SameSite=None, sparing you a browser rejection.
• Helpers::expirationToSeconds() – one consistent parser for every expiration value across the library. Numbers are relative seconds, while DateTimeInterface and textual strings like '20 minutes' or '2024-01-01' resolve as absolute times; each caller decides what null means in its own context.
• Helpers::parseQualityList() – parses HTTP quality-value lists (Accept, Accept-Language, …) into a ranked token map. Request::detectLanguage() was rewritten on top of it and is more correct as a result.

Released version 3.3.4

• RequestFactory::setForceHttps() – force the request scheme to HTTPS regardless of the server environment, handy behind proxies and load balancers that don't advertise TLS termination. Also exposed via the DI config option http: forceHttps: true.
• Request::getOrigin() now strictly follows RFC 6454 – returns null for any Origin header that isn't a bare scheme://host[:port] (e.g. headers containing a path are rejected instead of being silently accepted).
• Improved phpDoc types and descriptions across the whole Nette\Http namespace – better IDE autocompletion and PHPStan inference for Request, Response, Session, Url and friends.

Released version 3.3.3

• support for PHP 8.5
• optimized global function calls
• Url, UrlImmutable: user & password are deprecated

Released version 3.3.2

• UrlImmutable, UrlScript: added resolve()
• Url: added isAbsolute() & removeDotSegments()
• UrlImmutable, UrlScript: removed build() method
• Url::canonicalize() char " does not need to be encoded
• Url, UrlImmutable: user & password are deprecated
• FileUpload::__construct() accepts path
• SessionPanel: convert templates to Latte-like syntax

Released version 3.3.1

• support for PHP 8.4
• FileUpload::getSanitizedName() changes the extension only for image files #239
• RequestFactory: extract port from x-forwarded-host (#230)
• FileUpload: Initialize properties (#235)(#195)
• Session: keep exceptions chain on session_start (#240)
• Session: SessionSection class template annotation #225
• IResponse: added DateTimeInterface to setCookie $expire param (#237)
• readonly properties

Released version 3.3.0

• requires PHP 8.1
• uses PHP 8.1 features

Released version 3.2.4

• FileUpload: added getSuggestedExtension()
• RequestFactory: unify and fix host parsing (#229)

Released version 3.2.3

• support for PHP 8.3
• FileUpload: detects supported images
• RequestFactory: fixed port detection when HTTP_HOST & SERVER_PORT are used #223
• removed fix for IE

Released version 3.2.2

• SessionExtension: don't set readAndClose if null (#213)
• Improved https recognition behind load balancer (#221)
• RequestFactory: fix X-Forwarded-Host mixup with remote host (#222)
• RequestFactory: performance optimization #220
• RequestFactory: fixed filter detection
• Url: host can end with dot #198
• added Session::getSectionNames(), replacement for getIterator()