Page 8 - Symfony

A hundred percent code coverage says nothing about whether tests would actually catch bugs. Mutation testing with Infection artificially injects small faults into Symfony code and checks whether the test suite reliably catches every single one of them.

A single voter with twenty if branches is not an authorization system, it is a maintenance burden. This guide shows how multiple security voters in Symfony are composed cleanly, made reusable through abstract base voters, and combined with the right AccessDecisionManager strategy.

API Platform ships GraphQL support practically out of the box, but it comes bundled with a full resource, filter, and serialization stack that not every project needs. If you just want to put a lean GraphQL interface over an existing Symfony project, the base library webonyx/graphql-php often gets you there faster and with far less overhead, because schema and resolvers are defined directly and explicitly.

The bundle extension is the mechanism through which a Symfony bundle registers its services in the host container. Compiler passes go one step further and hook directly into the ContainerBuilder after all bundles have loaded, to collect tagged services or modify definitions. This article explains both mechanisms and how they work together.

The Symfony dependency injection container is more than a service locator. Decorators let you extend third-party services without touching their code. Compiler passes manipulate the container at build time and automate configurations that would otherwise have to be maintained by hand.

Anyone who needs to authenticate login forms, API keys or signed headers that no standard bundle covers cannot avoid writing a custom authenticator. With AuthenticatorInterface, Passport and Badges, any authentication logic can be implemented cleanly and testably, without detouring through the outdated Guard classes.

Anyone calling external APIs in PHP with cURL or Guzzle often ends up with fragile integrations that lack retry logic, clean mocking in tests, and type safety. Symfony HttpClient delivers all of that as part of the framework, with scoped clients, automatic retries, asynchronous concurrency and a MockHttpClient for fully isolated unit tests.

JWT or sessions for Symfony REST APIs? The answer depends on scaling requirements, revocation needs, client type, and security model. Anyone who understands the difference between stateless and stateful authentication can make the right decision for their specific use case.

The Symfony Profiler is more than the debug bar at the bottom of the page. It shows precisely which database queries slow down a page, where event listeners consume excessive time, which caches are not hitting, and how much memory a request uses, all at the push of a button, without a single code change.

Functional tests that are slow or keep failing because of database state problems simply do not get written, and the project loses its safety net. With WebTestCase, KernelTestCase, fixtures and clear conventions for database isolation, Symfony functional tests become the fast, reliable foundation of every deployment.