New in Symfony 5.1: HttpFoundation improvements

Warning: This post is about an unsupported Symfony version. Some of this information may be out of date. Read the most recent Symfony Docs.

Added InputBag

Contributed by
in #34363.

The ParameterBag class defined by Symfony is like an object-oriented array which stores related values and provides methods such as get(), set(), has(), etc. Symfony defines specialized ParameterBag classes for some purposes (e.g. FileBag for uploaded files, ServerBag for HTTP headers, etc.)

In Symfony 5.1 we've introduced a new InputBag class (which extends from ParameterBag) to manage values provided by the user (via $_GET, $_POST, $_REQUEST, and $_COOKIE superglobals).

Encrypted session data

Contributed by
Ahmed Tailouloute
in #35804.

Encrypting data is one of the recommended ways to minimize the damage caused by security leaks. In Symfony 5.1 you can encrypt the contents of the session using a new MarshallingSessionHandler, which in turn uses the marshaller from the Cache component.

Use the following configuration to define the needed data to encrypt the sessions:

    decorates: 'session.marshaller'
        - ['%env(file:resolve:SODIUM_DECRYPTION_FILE)%']
        - '@.inner'

Support all HTTP Cache-Control directives

Contributed by
in #35748.

Symfony supports the most used HTTP Cache-control directives (etag, last_modified, max_age, public , etc.). However, we were missing some of them, so we decided to add support for all cache-control directives in Symfony 5.1:

  • etag
  • immutable
  • last_modified
  • max_age
  • must_revalidate
  • no_cache
  • no_store
  • no_transform
  • private
  • proxy_revalidate
  • public
  • s_maxage
Help the Symfony project!

As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.


It would be so nice to have generics to implement all these bags …
@Josef : well, when Symfony will take over PHP, maybe Generics will be the first pushed RFC 🤣 In the meantime, having ArrayAccess + Traversable native interfaces already helps creating generics-like classes, and it's easier for BC (since you have total control over every method call and can trigger deprecations as much as you need, which is the case here)

Comments are closed.

To ensure that comments stay relevant, they are closed for old posts.