System\Twig\SecurityPolicy\SafeRequest

Overview

SafeRequest is a request proxy class that is safe for use in Twig.

It exposes an explicit subset of read-only methods to theme templates and blocks methods that expose server environment variables, request headers (which carry authentication credentials), cookies, or the raw request body. The underlying Illuminate\Http\Request is otherwise fully populated and would leak .env secrets, bearer tokens, and session cookies if exposed without restriction.

Implements

• October\Contracts\Twig\CallsAnyMethod

Protected Properties

protected Illuminate\Http\Request $request

request instance being proxied

protected array $allowedMethods

allowedMethods is the explicit Twig surface of the request. Anything not in this list is blocked, including server(), header(), cookie(), getContent(), bearerToken(), getPassword(), getUser(), session(), and user().

Public Methods

public __call()

public __call($method, $parameters): void

__call magic

public __construct()

public __construct($request): void

public __get()

public __get($key): void

__get proxies property access. Twig may access common request fields (e.g. {{ this.request.url }}) which Twig resolves via property access before falling back to a method call. We only expose method-call results, never the raw $server/$cookies/$headers bag properties.

public __isset()

public __isset($key): void

__isset is needed for Twig's defined check on property access.