Header
Header
Header-based session token transport.
class Header implements \Hazaar\Auth\Interface\SessionTransportImplements: Hazaar\Auth\Interface\SessionTransport
Handles extracting session tokens from inbound auth headers and optionally emitting outbound advisory token headers.
Properties
options
Options for configuring the header transport.
private array $optionsType: array
Methods
__construct
Constructor for HeaderTransport.
public __construct(array|Options $config): voidParameters
| Parameter | Type | Description |
|---|---|---|
$config | array | Hazaar\Auth\Session\Transport\Header\Options |
extractToken
Extracts the token from the configured HTTP request header.
public extractToken(array $options): ?stringReturns: string
When a non-empty prefix is configured (e.g. Bearer), the header value must start with <prefix> and the token is the remainder. When the prefix is empty, the raw header value is returned as-is.
Parameters
| Parameter | Type | Description |
|---|---|---|
$options | array |
extractRefreshToken
Extracts the refresh token from configured inbound refresh header options.
public extractRefreshToken(array $options): ?stringReturns: string
Parameters
| Parameter | Type | Description |
|---|---|---|
$options | array |
persistToken
Persists the access token as an outbound advisory response header.
public persistToken(Response $response, ExpiringToken $token, array $options): voidReturns: void
Because this is a client-managed transport, the server cannot guarantee the client will store or resend this header. A debug notice is logged as a reminder. When the prefix is empty (default), the token is written as the bare header value; otherwise it is prefixed as <prefix> <token>.
Parameters
| Parameter | Type | Description |
|---|---|---|
$response | Hazaar\Controller\Response | the response object where the header will be set |
$token | Hazaar\Auth\ExpiringToken | the authentication token to be persisted |
$options | array | optional settings for token persistence |
persistRefreshToken
Persists the refresh token in a dedicated outbound advisory response header.
public persistRefreshToken(Response $response, ExpiringToken $refreshToken, array $options): voidReturns: void
Parameters
| Parameter | Type | Description |
|---|---|---|
$response | Hazaar\Controller\Response | the response object to which the header will be added |
$refreshToken | Hazaar\Auth\ExpiringToken | the refresh token to persist |
$options | array | optional parameters for token persistence |
clearToken
Clears the advisory token headers from the response.
public clearToken(Response $response, array $options): voidReturns: void
Removes both the access-token and refresh-token headers so stale tokens are not forwarded to the client on logout or session expiry.
Parameters
| Parameter | Type | Description |
|---|---|---|
$response | Hazaar\Controller\Response | |
$options | array |
persistenceMode
Returns Hazaar\Auth\Enum\TransportPersistence::ClientManaged because HTTP headers
public persistenceMode(): TransportPersistenceReturns: Hazaar\Auth\Enum\TransportPersistence
are not stored or replayed by browsers automatically. The client must capture advisory token headers and include them on subsequent requests.
Generated by Hazaar API Doc Generator on Fri, 04 Sep 2026 23:32:17 +0000