Weave Code
Http Foundation Laravel Package
symfony/http-foundation
Symfony HttpFoundation provides an object-oriented layer for the HTTP specification in PHP, offering clean abstractions for requests, responses, headers, cookies, files, and sessions that work standalone or with any framework.
Defines an object-oriented layer for the HTTP specification
Frequently asked questions about Http Foundation
- What is symfony/http-foundation used for in Laravel?
- Symfony HttpFoundation provides object-oriented Request, Response, HeaderBag, Cookie, File, and Session objects for PHP's HTTP layer. Laravel uses it beneath Illuminate\Http\Request and Illuminate\Http\Response, so most Laravel developers consume it transitively rather than directly. It is useful when you need framework-agnostic HTTP objects, custom middleware, API clients, or a clean replacement for raw $_GET and $_POST access.
- How do I install symfony/http-foundation in a Laravel project?
- In a standard Laravel application you usually do not install it directly because laravel/framework already requires a compatible Symfony HttpFoundation branch. Run composer why symfony/http-foundation to see which version your Laravel release resolves. For standalone or non-Laravel use, run composer require symfony/http-foundation and choose a branch compatible with your PHP version.
- Which Laravel and PHP versions support symfony/http-foundation?
- Laravel version support is driven by laravel/framework's Composer constraints, not by this package alone. The 5.4 branch supports PHP 7.2.5 and later and is used by older Laravel lines, while newer Laravel releases require Symfony 6 or 7 branches. Check your Laravel upgrade guide and Composer constraints before changing versions.
- Does Laravel use Symfony HttpFoundation under the hood?
- Yes. Illuminate\Http\Request and Illuminate\Http\Response are thin wrappers or decorators around Symfony HttpFoundation classes. Laravel middleware, cookies, file uploads, and sessions build on this component. Replacing it in a standard Laravel app is not practical.
- What breaking changes are in symfony/http-foundation v5.4.54?
- Version 5.4.54 is a tagged security release with 15 changes, backporting fixes previously reviewed for newer branches. It tightens header parsing, response-header injection surfaces, cookie and path validation, trusted-host regex handling, and SodiumMarshaller decryption behavior. No public signatures were removed, but previously tolerated cookie paths, domains, X-Sendfile-Type values, and very large trusted-host pattern sets can now fail or behave differently. Test custom header and cookie configuration before upgrading.
- Will the v5.4.54 security fixes affect custom cookies or X-Sendfile headers?
- Yes, if you set non-standard cookie paths or domains, or inject X-Sendfile-Type or X-Accel-Redirect headers. Reserved characters in cookie paths and domains and structurally invalid paths are now rejected, and X-Sendfile-Type is allow-listed. Custom Nginx X-Sendfile setups using a non-standard type string may silently stop emitting that header. Audit decorators and middleware that write these headers or cookies.
- How do I test code that uses Symfony HttpFoundation Request and Response?
- Create Request objects from server, query, and cookie arrays or from globals, then assert on Response status, headers, and content. Symfony HttpFoundation is framework-agnostic, so PHPUnit tests do not need a running Laravel application. For Laravel integration, use Laravel's HTTP tests but drop to component-level tests for header parsing, cookie validation, and trusted-host edge cases.
- Is symfony/http-foundation safe for production use?
- Yes, it is the HTTP foundation used by Laravel and Symfony in production, and v5.4.54 addresses multiple security-sensitive parsing and header-emission paths. The main production concern is configuration compatibility after the stricter validation. Run your test suite and smoke-test cookies, trusted hosts, and file-delivery headers before deploying.
- What alternatives exist to symfony/http-foundation?
- Within Laravel there is no practical alternative because the framework is built on this component. Standalone PHP alternatives include PSR-7 implementations such as nyholm/psr7 or guzzlehttp/psr7, but they do not replace Laravel's Request and Response API. Choose HttpFoundation for Symfony- and Laravel-compatible HTTP objects, or PSR-7 when integrating with PSR-15 middleware and HTTP clients.
- How is symfony/http-foundation maintained and should I pin versions?
- It is maintained as part of the Symfony project with regular releases and security backports to supported branches. Pin versions through your lock file and monitor Symfony security advisories. The v5.4.54 release shows fixes are backported to older lines, but verify each branch independently rather than assuming a fix exists everywhere.
Weaver
How can I help you explore Laravel packages today?