DEV Community: Stiven Llupa

The Scenic Route to TYPO3 DevDays

Stiven Llupa — Tue, 11 Aug 2026 08:16:24 +0000

Maps gave me two options to the conference venue: walk alongside the highway, or cut through "the park."

Naturally, I picked the park. Who wouldn't with this in its entry?

What Maps called a park was, in fact, a forest 🌲. So there I was, conference-ready, laptop bag slung over my shoulder, nice shoes and all, strolling through actual woods like I was auditioning for a hiking ad. 🚶

Further in, the path was flooded. Someone before me had improvised a bridge out of what I can only describe as twigs (they were, structurally speaking, not twigs, and I chose not to think too hard about that while crossing).

Then, just when I was sure I'd finally reach the venue, the trees opened up onto a cornfield. A full, sprawling cornfield. I stood there for a second, looked around, and just laughed. This is awesome.

And there it was: the conference center, right on the other side.

A colleague and I had been invited over from the Symfony community and TYPO3 has adopted a good chunk of Symfony components under the hood, so the overlap made sense. TYPO3 DevDays itself kept that same energy going: warm, welcoming, genuinely good vibes from start to finish. But the thing that made me think more than the forest, the bridge, or the corn.

It was how many speakers, across totally different talks, kept circling back to the same idea: build for your users. Not for the framework, not for the demo, not for what's technically impressive, but for the actual person on the other end.

Now that the walk and conference has finished, I am stuck with two things. First, how crazy it was to walk through a forest to reach a tech-con 😅 and second, the importance of end user feels like it is always implied, but never really actively worked on. (I am look at you 👀, stake-holders 🧑‍💼)

Defensive Programming can be very easy with Symfony HttpClient

Stiven Llupa — Sat, 28 Feb 2026 18:37:39 +0000

If your app lets users submit URLs that you then fetch, for link previews, webhooks, or RSS feeds, you have a serious security problem waiting to happen.

An attacker can submit something like http://127.0.0.1/admin or http://169.254.169.254 (AWS metadata endpoint) and your server will happily fetch it.

That's called a Server-Side Request Forgery attack, or SSRF.

Symfony has a built-in solution: NoPrivateNetworkHttpClient.

So your code:

class LinkPreviewController
{
    public function __construct(
        private HttpClientInterface $client,
    ) {}

    #[Route('/api/preview', methods: ['POST'])]
    public function preview(
        Request $request,
    ): JsonResponse {
        $url = $request->getPayload()
            ->getString('url');

        $response = $this->client
            ->request('GET', $url);

        return new JsonResponse(
            $response->getContent()
        );
    }
}

Becomes:

class LinkPreviewController
{
    private HttpClientInterface $safeClient;

    public function __construct(
        HttpClientInterface $client,
    ) {
        $this->safeClient =
            new NoPrivateNetworkHttpClient(
                $client
            );
    }

    #[Route('/api/preview', methods: ['POST'])]
    public function preview(
        Request $request,
    ): JsonResponse {
        $url = $request->getPayload()
            ->getString('url');

        $response = $this->safeClient
            ->request('GET', $url);

        return new JsonResponse(
            $response->getContent()
        );
    }
}

It's a decorator, so you just wrap your existing client & no other changes needed. Follow the documentation to set your specific IPs or IP ranges that you want to disallow.

If you fetch user-submitted URLs and you're not using this, you should be.

Watch in on YouTube

Country codes and regional differences

Stiven Llupa — Sat, 28 Feb 2026 09:38:49 +0000

Here's a little-known Symfony trick for apps that need to support Kosovo as a country.

Kosovo uses the code XK, but that's not an official ISO 3166 code. It is what is called a user-assigned code, meaning Symfony Intl component doesn't include it by default.

So when you call Countries::getNames() from the Symfony Intl component, Kosovo simply won't appear.

use Symfony\Component\Intl\Countries;

$countries = Countries::getNames();

isset($countries['XK']); // false

Countries::getName('XK'); // Throws MissingResourceException

The fix? Just set this environment variable in your .env file:

# .env

SYMFONY_INTL_WITH_USER_ASSIGNED=true

That's it. Symfony will now also recognize XK, XKK, and numeric code 983 for Kosovo.

use Symfony\Component\Intl\Countries;

Countries::getName('XK'); // 'Kosovo'

Countries::getAlpha2Code('XKK') // XK
Countries::getAlpha3Code('XK') // XKK  
Countries::getNumericCode('XK') // 983

A one-liner that saves you from building a workaround. Super useful if you're building apps for any region that needs user-assigned country codes.

Stop writing the same regex for #[Route]

Stiven Llupa — Fri, 27 Feb 2026 18:08:10 +0000

Did you know Symfony ships with a built-in class full of pre-defined route requirement patterns?

It's called Requirement, and it lives in Symfony\Component\Routing\Requirement.

Instead of writing your own regex for common route parameters like UUIDs, slugs, date formats, or locale codes, you can just reference a constant.

So instead of this mess in your route attribute:

#[Route('/users/{id}', requirements: [
    'id' => '[0-9a-f]{8}-[0-9a-f]{4}-'
          . '[0-9a-f]{4}-[0-9a-f]{4}-'
          . '[0-9a-f]{12}',
])]
public function show(string $id): Response
{
    // ...
}

You write:

#[Route('/users/{id}', requirements: [
    'id' => Requirement::UUID,
])]
public function show(string $id): Response
{
    // ...
}

Instead of:

#[Route('/blog/{slug}', requirements: [
    'slug' => '[a-z0-9]+(?:-[a-z0-9]+)*',
])]
public function post(string $slug): Response
{
    // ...
}

You write:

#[Route('/blog/{slug}', requirements: [
    'slug' => Requirement::ASCII_SLUG,
])]
public function post(string $slug): Response
{
    // ...
}

It includes constants for all UUID formats, common date, ASCII slugs, and your usual suspects.

Stop rewriting the same regex. Symfony already did it for you.

Watch it on YouTube