DEV Community: Stiven Llupa

Defensive Programming can be very easy with Symfony HttpClient

Stiven Llupa — Sat, 28 Feb 2026 18:37:39 +0000

If your app lets users submit URLs that you then fetch, for link previews, webhooks, or RSS feeds, you have a serious security problem waiting to happen.

An attacker can submit something like http://127.0.0.1/admin or http://169.254.169.254 (AWS metadata endpoint) and your server will happily fetch it.

That's called a Server-Side Request Forgery attack, or SSRF.

Symfony has a built-in solution: NoPrivateNetworkHttpClient.

So your code:

class LinkPreviewController
{
    public function __construct(
        private HttpClientInterface $client,
    ) {}

    #[Route('/api/preview', methods: ['POST'])]
    public function preview(
        Request $request,
    ): JsonResponse {
        $url = $request->getPayload()
            ->getString('url');

        $response = $this->client
            ->request('GET', $url);

        return new JsonResponse(
            $response->getContent()
        );
    }
}

Becomes:

class LinkPreviewController
{
    private HttpClientInterface $safeClient;

    public function __construct(
        HttpClientInterface $client,
    ) {
        $this->safeClient =
            new NoPrivateNetworkHttpClient(
                $client
            );
    }

    #[Route('/api/preview', methods: ['POST'])]
    public function preview(
        Request $request,
    ): JsonResponse {
        $url = $request->getPayload()
            ->getString('url');

        $response = $this->safeClient
            ->request('GET', $url);

        return new JsonResponse(
            $response->getContent()
        );
    }
}

It's a decorator, so you just wrap your existing client & no other changes needed. Follow the documentation to set your specific IPs or IP ranges that you want to disallow.

If you fetch user-submitted URLs and you're not using this, you should be.

Watch in on YouTube

Country codes and regional differences

Stiven Llupa — Sat, 28 Feb 2026 09:38:49 +0000

Here's a little-known Symfony trick for apps that need to support Kosovo as a country.

Kosovo uses the code XK, but that's not an official ISO 3166 code. It is what is called a user-assigned code, meaning Symfony Intl component doesn't include it by default.

So when you call Countries::getNames() from the Symfony Intl component, Kosovo simply won't appear.

use Symfony\Component\Intl\Countries;

$countries = Countries::getNames();

isset($countries['XK']); // false

Countries::getName('XK'); // Throws MissingResourceException

The fix? Just set this environment variable in your .env file:

# .env

SYMFONY_INTL_WITH_USER_ASSIGNED=true

That's it. Symfony will now also recognize XK, XKK, and numeric code 983 for Kosovo.

use Symfony\Component\Intl\Countries;

Countries::getName('XK'); // 'Kosovo'

Countries::getAlpha2Code('XKK') // XK
Countries::getAlpha3Code('XK') // XKK  
Countries::getNumericCode('XK') // 983

A one-liner that saves you from building a workaround. Super useful if you're building apps for any region that needs user-assigned country codes.

Stop writing the same regex for #[Route]

Stiven Llupa — Fri, 27 Feb 2026 18:08:10 +0000

Did you know Symfony ships with a built-in class full of pre-defined route requirement patterns?

It's called Requirement, and it lives in Symfony\Component\Routing\Requirement.

Instead of writing your own regex for common route parameters like UUIDs, slugs, date formats, or locale codes, you can just reference a constant.

So instead of this mess in your route attribute:

#[Route('/users/{id}', requirements: [
    'id' => '[0-9a-f]{8}-[0-9a-f]{4}-'
          . '[0-9a-f]{4}-[0-9a-f]{4}-'
          . '[0-9a-f]{12}',
])]
public function show(string $id): Response
{
    // ...
}

You write:

#[Route('/users/{id}', requirements: [
    'id' => Requirement::UUID,
])]
public function show(string $id): Response
{
    // ...
}

Instead of:

#[Route('/blog/{slug}', requirements: [
    'slug' => '[a-z0-9]+(?:-[a-z0-9]+)*',
])]
public function post(string $slug): Response
{
    // ...
}

You write:

#[Route('/blog/{slug}', requirements: [
    'slug' => Requirement::ASCII_SLUG,
])]
public function post(string $slug): Response
{
    // ...
}

It includes constants for all UUID formats, common date, ASCII slugs, and your usual suspects.

Stop rewriting the same regex. Symfony already did it for you.

Watch it on YouTube