RESTful API vs REST API: Is There Actually a Difference?
What is REST? REST (Representational State Transfer) is an architectural style , not a protocol or a standard. It was introduced by Roy Fielding in…
Latest News
⚑ Report a ProblemTech news from the best sources
All topics
AI
Gear
News
Tech
agents
ai
api
architecture
automation
beginners
career
database
devchallenge
devops
discuss
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
security
showdev
testing
tutorial
typescript
webdev
Don't blame AI before you check your architecture
Give an AI coding agent a small task: add voucher activation to an existing subscription system. The generated code might look reasonable. The endpo…
Lean Software Development in Practice: Finding Muda in Four PHP Projects
Lean has one word that I like because it is brutally simple: Muda . Waste. In a factory, waste is often visible. Extra movement. Waiting. Too much i…
Postgres RLS in Symfony: a setup check for a missing FORCE, and two ways it says "nothing to report" without looking
Three articles ago I wrote that the Postgres role which runs your migrations bypasses every row-level security policy, unless the table has FORCE RO…
Doppar 4 Has Been Released, and Here Is Why It Is Special
Doppar 4.0 is out today. I want to start this post with something I haven't said out loud before. Doppar 3.0 was a good framework, but if you put it…
Dependency Injection in Go, After Years of Symfony
The container I had, the container I don't have, and what I do instead. 👋 I'm Anton - a software engineer working mostly in PHP/Symfony and Go, curr…
Postgres RLS in Symfony: three green isolation tests, and the UPDATE that moves tenant 1's invoices into tenant 2's books
Two articles ago I wrote that the Postgres role which runs your migrations bypasses every row-level security policy. Last week I wrote that with one…
100% line coverage did not catch the one bug that mattered
Symfony shipped a TUI component in 8.1 — a widget tree, a layout engine and a renderer for building full-screen terminal applications in PHP. One th…
Six Months Later, the Bundle Is Still Alive
So, it's been half a year since the first stable version of Symfony JSON Schema Validation Bundle was released, which turned out to be version 3. So…
The POST was guarded, the GET on the same URL was not: cross-tenant PII disclosure in CoopCycle (GET /api/stores/{id}/addresses)
TL;DR What: In coopcycle-web — the open-source logistics and marketplace platform that worker-owned courier co-operatives self-host instead of renti…
Catching Risky Doctrine Migrations Before Production
Database migrations are one of those things that often look harmless during code review. A migration may contain only a few lines of SQL, the applic…
Preventing lost updates in Symfony APIs with ETags and Doctrine
There is a concurrency problem in APIs that is easy to miss. Two clients read the same resource: Client A -> GET /documents/42 Client B -> GET…
I made a Symfony bundle for masking sensitive data
I recently released a small open-source Symfony bundle called MaskedBundle . The reason for building it was quite simple: logs are useful, but somet…
Row-level security in Symfony: the role that ran your migrations bypasses every policy you wrote
A comment on my last article was better than the article. The subject was single-database multi-tenancy, and @to21as argued that the predicate shoul…
Single-database multi-tenancy in Symfony: a 31-line Doctrine filter, and the five places it never runs
Single-database multi-tenancy is the cheapest kind: one schema, one connection, an organization_id column on every tenant-owned table. The whole des…
How to upload a file over JSON-RPC, when JSON has no type for a file
JSON has no representation for a file. Strings, numbers, arrays, objects - that is the whole list. So every JSON-RPC API eventually runs into the sa…
Symfony and PHP 8.4: Modernizing Without Rewriting Everything
Upgrading a Symfony application to PHP 8.4 doesn't have to mean rewriting half the codebase. For applications that have been running in production f…
Are You Really Making the Most of Static Code Analysis?
If you write PHP and work with Symfony every day, chances are you’ve already run PHPStan or Psalm, or at least heard of Rector. But let’s be honest:…
One DSN, three PHP ecosystems: MailKite's Symfony Mailer transport
mailkite/symfony-mailer resolves a mailkite+api:// DSN into a first-party Symfony Mailer transport — which means Mautic, PrestaShop, Drupal, and any…
Building an embedded Shopify app in Symfony: session tokens, token exchange, and the parts nobody writes in PHP
Shopify's app documentation has exactly one first-class path: Node, the official CLI, and a Remix template that wires authentication for you. Pick a…
Contract testing a Symfony API with OpenAPI
Contract testing a Symfony API with OpenAPI takes four moving parts: the OpenAPI spec, a WebTestCase (or a plain Request / Response pair), one trait…
UI Kernel: Design Tokens as Symfony infrastructure
For years, Symfony teams solved UI scaling one of two ways. Either you adopted a JavaScript build pipeline — Webpack Encore, Vite, npm scripts — and…
Migrating Laravel to Symfony Without Rewriting Your Domain
Book: Decoupled PHP — Clean and Hexagonal Architecture for Applications That Outlive the Framework Also by me: Thinking in Go (2-book series) — Comp…
Symfony Messenger Transports: Building a Transactional Outbox on Top
Book: Decoupled PHP — Clean and Hexagonal Architecture for Applications That Outlive the Framework Also by me: Thinking in Go (2-book series) — Comp…
The Symfony Scheduler Component: Cron in Your App, Not Your Crontab
Book: Decoupled PHP — Clean and Hexagonal Architecture for Applications That Outlive the Framework Also by me: Thinking in Go (2-book series) — Comp…
Symfony: Validating & Secure your API Requests
When you build an API, the first line of defense isn't your firewall or your database — it's the request itself. Every payload that hits your contro…
The Problem with Calendars in Livewire and UX Live Components
Why JavaScript Calendar Libraries Fail Here The go-to solution for a calendar has been a JavaScript widget: FullCalendar, Pikaday, flatpickr, or one…
Keeping Doctrine Entities Honest with DTOs and ObjectMapper
Originally posted on https://symfonycasts.com/blog/honest-entities Your Doctrine entities are lying to you! For years, the standard way to build Doc…
Omnia Ipsum: Unified placeholder content for Symfony
A prototype web page displaying pure placeholder content When building early UI prototypes or shaping design systems in Symfony, placeholder content…
Mastering Symfony Security, Passports and Custom Authenticators
Security is the cornerstone of any modern web application, but historically, implementing robust authentication and authorization mechanisms has bee…