New in Symfony 8.1: DX Improvements (Part 2)

Javier Eguiluz — Thu, 11 Jun 2026 09:15:00 +0200

Symfony 8.1 includes many small features and improvements across different components. This is the second article in the series that highlights some of the most useful DX (developer experience) improvements.

Map Request Headers to Controller Arguments

Contributed by Steven RENAUX in #51379

Symfony provides several attributes, such as #[MapQueryParameter] and #[MapRequestPayload], to map parts of the HTTP request to controller arguments. However, there was no equivalent for HTTP headers, so you had to inject the entire Request object just to read one of them.

In Symfony 8.1 we're introducing a new #[MapRequestHeader] attribute to map request headers directly to controller arguments:

        
        use Symfony\Component\HttpFoundation\AcceptHeader;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpKernel\Attribute\MapRequestHeader;

class DashboardController extends AbstractController
{
    public function index(
        // argument names are converted from camelCase to the
        // kebab-case header name (in this case: accept-language)
        #[MapRequestHeader] string $acceptLanguage,

        // use the 'name' option when the header name cannot be
        // derived from the argument name
        #[MapRequestHeader(name: 'x-request-id')] ?string $requestId,

        // type-hint the argument as array to get all the header values
        #[MapRequestHeader] array $accept,

        // type-hint it as AcceptHeader to get a parsed object that
        // allows sorting and filtering values by their quality
        #[MapRequestHeader] AcceptHeader $acceptEncoding,
    ): Response {
        // ...
    }
}
    

If a required header is missing, Symfony returns a 400 Bad Request response. You can customize this status code with the validationFailedStatusCode option of the attribute.

Use the Controller Instance in Security Expressions

Contributed by Valtteri R in #63201

The #[IsGranted] attribute accepts an expression as its subject option. Inside that expression, you could only use the request and args variables. This was an issue for invokable classes that store their state in properties (e.g. live components), because there was no way to pass those properties as the subject.

In Symfony 8.1, subject expressions can also use a new this variable, which refers to the controller instance itself:

        
        use Symfony\Component\ExpressionLanguage\Expression;
use Symfony\Component\Security\Http\Attribute\IsGranted;
use Symfony\UX\LiveComponent\Attribute\AsLiveComponent;
use Symfony\UX\LiveComponent\Attribute\LiveProp;

#[AsLiveComponent]
class PostComponent
{
    #[LiveProp]
    public Post $post;

    // 'this' refers to this PostComponent instance, so you can use
    // any of its properties and methods as the subject
    #[IsGranted('POST_EDIT', subject: new Expression('this.post'))]
    public function __invoke(): void
    {
        // ...
    }
}
    

CSP-Compliant `dump()` Output

Contributed by Pascal CESCON in #63762 and #64087

The dump() function renders its HTML output using inline

Symfony Blog

New in Symfony 8.1: DX Improvements (Part 2)

Map Request Headers to Controller Arguments

Use the Controller Instance in Security Expressions

CSP-Compliant dump() Output

CSP-Compliant `dump()` Output