README

HTTP kernel, middleware, and exception handling

Status

Initial extraction snapshot from denosyscore monorepo as of 2026-02-14.

Installation

composer require denosyscore/http

Included Modules

src/Http/*
src/Exceptions/*
src/Security/*

PSR response security headers

The HTTP kernel attaches the existing default security policy to every returned PSR-7 response before dispatching ResponseReady. It sets X-Content-Type-Options: nosniff, X-Frame-Options: DENY, and the existing X-XSS-Protection default. HTTPS requests also receive Strict-Transport-Security. Explicit response headers take precedence over these defaults.

The existing SecurityHeadersServiceProvider remains available for consumers that rely on native SAPI headers. Direct kernel handling and alternate emitters receive the policy through the returned response object.

JSON request bodies

Denosys\Http\Middleware\JsonBodyParserMiddleware is an opt-in PSR-15 middleware. Register it before CSRF checks and request validation so JSON object and array bodies become available through getParsedBody() and Denosys\Http\Request::input(). It accepts application/json (including charset parameters) and application/*+json media types.

The middleware leaves non-JSON and already populated parsed bodies unchanged. An empty JSON body is left for the application's normal validation rules; malformed or scalar JSON returns a JSON 400 response. Seekable request-body streams retain their cursor position after parsing. An unreadable request-body stream returns a JSON 500 response rather than being treated as empty input.

Development

composer validate --strict find src -type f -name '*.php' -print0 | xargs -0 -n1 php -l composer test

CI Workflows

CI: Composer validation, isolated dependency installation, HTTP tests, and PHP syntax lint on push and pull requests.
Release: GitHub release publication on semantic version tags.
Dependabot: weekly Composer dependency update checks.

denosyscore / http

Package info

Security

Statistics