README

A lightweight, modern PHP 8.2+ routing library with pattern matching, parameter extraction, middleware support, and secure dispatching.

Features

Pattern-based routing with named parameters ({id}, {name}, etc.)
Flexible handler registration (closures, class methods, strings)
Secure dispatching with path traversal protection
Type-safe parameters (int, float, bool automatic casting)
Built-in middleware for CSRF protection and CORS headers
Secure response builder with XSS prevention
PSR-4 autoloading compatible

Installation

Via Composer:

composer require leocore/router

Or use directly (no dependencies needed):

git clone https://github.com/Rocklviv/leocore-router.git
cd leocore-router

Usage Examples

Simple closure handler

use App\Router\Router;
use App\Router\Response;

$router = new Router();
$router->add('/health', fn() => new Response('OK - System Operational', 200));

Handler with parameters

$router->add('/users/{id}', fn(int $id) => new Response("User #{$id}", 200));

Class method handler

$router->add('/api/data/{id}', [DataHandler::class, 'getData'], ['GET', 'DELETE']);

Multiple HTTP methods

$router->add('/users', fn() => new Response('Users list'), ['GET']);
$router->add('/users', fn() => new Response('Create user', 201), ['POST']);

Middleware example

use App\Router\Middleware\Csrf;
use App\Router\Middleware\Cors;

$router = new Router();

// Register CSRF middleware for state-changing routes
$router->add('/users', fn() => new Response('Users'), ['GET'], [
    new Csrf()
]);

// Register CORS middleware
$router->add('/api/*', fn() => new Response('API'), ['GET'], [
    new Cors(['origin' => 'https://example.com'])
]);

Dispatching requests

$router->add('/users/{id}', fn(int $id) => new Response("User #{$id}", 200));

// Dispatch a request
$response = $router->dispatch('GET', '/users/123');
echo $response->getContent(); // Outputs: User #123

API Documentation

Router Class

`__construct()`

Initialize the router.

`add(string $path, callable|array|string $handler, array $methods = ['GET'], array $middleware = [])`

Parameters:

$path: Route pattern (e.g., /users/{id})
$handler: Closure, array of [ClassName, method], or string 'ClassName::method'
$methods: Array of HTTP methods (GET, POST, PUT, etc.)
$middleware: Optional array of middleware instances

`dispatch(string $method, string $path, ?array $headers = null): Response`

Dispatch a request to the matched route.

Parameters:

$method: HTTP method (GET, POST, PUT, DELETE, PATCH, OPTIONS)
$path: Request path (without query string)
$headers: Optional array of headers (for CLI/testing)

Returns: Response object

`dumpRoutes(): array`

Get all registered routes for debugging.

Returns: Array of route configurations

Middleware

`Csrf`

CSRF token generation and validation middleware. Returns 403 for invalid tokens.

`Cors`

CORS header middleware with configurable origin and methods.

Security Features

Path traversal protection: Blocks .. and null bytes in URLs
Method normalization: Prevents HTTP method injection
CSRF protection: Session-based token validation for state-changing operations
CORS control: Configurable per-route or global CORS headers
XSS prevention: htmlspecialchars() on all response content
Input sanitization: Type casting and whitelist validation

License

MIT License - see LICENSE file for details.

leocore / router

Maintainers

Package info

Statistics

Security