$ show symfony/http-foundation
Symfony HttpFoundation is a production-grade PHP library that implements an object-oriented layer for the HTTP specification. It provides the core abstractions for HTTP request/response handling, including Request, Response, RedirectResponse, JsonResponse, StreamedResponse, BinaryFileResponse, and EventStreamResponse. It also covers header and parameter containers, cookie parsing and serialization, file uploads, session management with multiple storage backends, IP validation and anonymization, content negotiation, request matchers, URI signing, rate limiting, and streaming JSON output. This is not an application or service; it is a library component consumed by the Symfony framework and standalone PHP projects, with no executable entry points or web endpoints. Architecturally, the code is organized around small, focused classes with clear separation of concerns: bag containers for parameters/headers, decorators and proxies for session handlers, immutable-ish value objects like Cookie, and static utility classes such as IpUtils and HeaderUtils. The component relies on modern PHP (>=8.4.1), optional integrations with Redis, Memcached, MongoDB, PDO/Doctrine DBAL, and Symfony Cache/Mime contracts. The test suite is extensive, covering both unit behavior and real HTTP functional scenarios against PHP's built-in server. The library demonstrates strong craftsmanship: type-safe getters, fluent builders, robust RFC-aware parsing utilities, and consistent deprecation policies. The most reusable pieces are self-contained utilities and value objects that can be extracted into other projects with minimal modification. Maintenance is active, with recent commits and a clear 8.2 branch; technical drift is low despite the long history because deprecations are systematically managed and PHP/Symfony versions are current.
The LLM identified 5 files worth highlighting for reuse:
A pure static utility class for parsing and manipulating HTTP headers. It handles quoted strings, escaping, splitting/combining header values, Content-Disposition parsing, and query-string parsing. It has zero internal dependencies and can be dropped into any PHP project needing robust, spec-compliant header processing.
Provides production-grade IPv4/IPv6 CIDR matching, private subnet detection, IP anonymization, and validation. Used by Request for trusted proxy handling and by IpRequestMatcher. Fully self-contained and directly reusable in security, middleware, or networking contexts.
An immutable cookie value object with rich fluent `with*()` methods for creating variants. Supports RFC 6265 attribute parsing, __Host-/__Secure- prefix validation, SameSite and Partitioned attributes, and raw cookie header deserialization via fromString(). It is a model example of safe cookie handling and can be extracted independently.
Implements HMAC-based URI signing with optional expiration and version tokens. Provides sign(), check(), checkRequest(), and verify() methods. The implementation is self-contained and demonstrates a secure, reusable pattern for preventing URL tampering or restricting URL validity windows.
A highly configurable PDO-backed session handler supporting MySQL, PostgreSQL, SQLite, Oracle, and SQL Server. It implements advisory and transaction-based locking to prevent race conditions, supports lazy database connections, custom table/column names, TTL, and automatic schema creation through Doctrine DBAL. This is a strong reusable pattern for database session storage beyond Symfony.