The Silex Book

generated on April 10, 2019

The Silex Book
This work is licensed under the “Attribution-Share Alike 3.0 Unported” license (http://creativecommons.org/
licenses/by-sa/3.0/).
You are free to share (to copy, distribute and transmit the work), and to remix (to adapt the work) under the
following conditions:

• Attribution: You must attribute the work in the manner specified by the author or licensor (but not in
any way that suggests that they endorse you or your use of the work).
• Share Alike: If you alter, transform, or build upon this work, you may distribute the resulting work only
under the same, similar or a compatible license. For any reuse or distribution, you must make clear to
others the license terms of this work.

The information in this book is distributed on an “as is” basis, without warranty. Although every precaution
has been taken in the preparation of this work, neither the author(s) nor SensioLabs shall have any liability to
any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by
the information contained in this work.
Contents at a Glance

Introduction .......................................................................................................................................5
Usage .................................................................................................................................................7
Middleware ......................................................................................................................................20
Organizing Controllers......................................................................................................................23
Services.............................................................................................................................................25
Providers ..........................................................................................................................................30
Testing .............................................................................................................................................35
Accepting a JSON Request Body .......................................................................................................39
Using PdoSessionStorage to store Sessions in the Database.................................................................41
Disabling CSRF Protection on a Form using the FormExtension.........................................................43
Using YAML to configure Validation .................................................................................................44
Making sub-Requests ........................................................................................................................45
Converting Errors to Exceptions........................................................................................................48
Using multiple Monolog Loggers.......................................................................................................50
How to Create a Custom Authentication System with Guard .............................................................52
Internals ...........................................................................................................................................55
Contributing.....................................................................................................................................57
Twig.................................................................................................................................................59
Asset ................................................................................................................................................63
Monolog...........................................................................................................................................65
Session .............................................................................................................................................68
Swiftmailer .......................................................................................................................................71
Locale...............................................................................................................................................74
Translation .......................................................................................................................................75
Validator ..........................................................................................................................................79
Form ................................................................................................................................................83
CSRF................................................................................................................................................87
HTTP Cache.....................................................................................................................................89
HTTP Fragment................................................................................................................................92
Security ............................................................................................................................................94
Remember Me ................................................................................................................................ 106
Serializer......................................................................................................................................... 108
Service Controllers .......................................................................................................................... 110
Var Dumper.................................................................................................................................... 113
Doctrine ......................................................................................................................................... 115
Routing .......................................................................................................................................... 118

PDF brought to you by Contents at a Glance | iii

generated on April 10, 2019
Webserver Configuration ................................................................................................................ 120
Changelog ...................................................................................................................................... 124

iv | Contents at a Glance Contents at a Glance | 4

 Chapter 1
Introduction

Silex is a PHP microframework. It is built on the shoulders of Symfony1 and Pimple2 and also inspired by
Sinatra3.
Silex aims to be:

• Concise: Silex exposes an intuitive and concise API.

• Extensible: Silex has an extension system based around the Pimple service-container that makes it
easy to tie in third party libraries.
• Testable: Silex uses Symfony's HttpKernel which abstracts request and response. This makes it very
easy to test apps and the framework itself. It also respects the HTTP specification and encourages
its proper use.

In a nutshell, you define controllers and map them to routes, all in one step.

Usage
Listing 1-1 1 <?php
2
3 // web/index.php
4 require_once __DIR__.'/../vendor/autoload.php';
5
6 $app = new Silex\Application();
7
8 $app->get('/hello/{name}', function ($name) use ($app) {
9 return 'Hello '.$app->escape($name);
10 });
11
12 $app->run();

All that is needed to get access to the Framework is to include the autoloader.
Next, a route for /hello/{name} that matches for GET requests is defined. When the route matches,
the function is executed and the return value is sent back to the client.

1. https://symfony.com/
2. https://pimple.symfony.com/
3. http://www.sinatrarb.com/

PDF brought to you by Chapter 1: Introduction | 5

generated on April 10, 2019

Finally, the app is run. Visit /hello/world to see the result. It's really that easy!

PDF brought to you by Chapter 1: Introduction | 6

generated on April 10, 2019

 Chapter 2
Usage

Installation
If you want to get started fast, use the Silex Skeleton1:

Listing 2-1 1 composer create-project fabpot/silex-skeleton path/to/install "~2.0"

If you want more flexibility, use Composer2 instead:

Listing 2-2 1 composer require silex/silex:~2.0

Web Server
All examples in the documentation rely on a well-configured web server; read the webserver
documentation to check yours.

Bootstrap
To bootstrap Silex, all you need to do is require the vendor/autoload.php file and create an instance
of Silex\Application. After your controller definitions, call the run method on your application:

Listing 2-3 1 // web/index.php

2 require_once __DIR__.'/../vendor/autoload.php';
3
4 $app = new Silex\Application();
5
6 // ... definitions

1. https://github.com/silexphp/Silex-Skeleton
2. https://getcomposer.org/

PDF brought to you by Chapter 2: Usage | 7

generated on April 10, 2019

 7
8 $app->run();

When developing a website, you might want to turn on the debug mode to ease debugging:
$app['debug'] = true;
Listing 2-4

If your application is hosted behind a reverse proxy at address $ip, and you want Silex to trust the
X-Forwarded-For* headers, you will need to run your application like this:
use Symfony\Component\HttpFoundation\Request;
Listing 2-5

Request::setTrustedProxies(array($ip));
$app->run();

Routing
In Silex you define a route and the controller that is called when that route is matched. A route pattern
consists of:

• Pattern: The route pattern defines a path that points to a resource. The pattern can include variable
parts and you are able to set RegExp requirements for them.
• Method: One of the following HTTP methods: GET, POST, PUT, DELETE, PATCH, or OPTIONS. This describes
the interaction with the resource.

The controller is defined using a closure like this:

Listing 2-6
function () {
// ... do something
}

The return value of the closure becomes the content of the page.

Example GET Route

Here is an example definition of a GET route:

Listing 2-7 1 $blogPosts = array(

2 1 => array(
3 'date' => '2011-03-29',
4 'author' => 'igorw',
5 'title' => 'Using Silex',
6 'body' => '...',
7 ),
8 );
9
10 $app->get('/blog', function () use ($blogPosts) {
11 $output = '';
12 foreach ($blogPosts as $post) {
13 $output .= $post['title'];
14 $output .= '<br />';
15 }
16
17 return $output;
18 });

PDF brought to you by Chapter 2: Usage | 8

generated on April 10, 2019

 Visiting /blog will return a list of blog post titles. The use statement means something different in this
context. It tells the closure to import the $blogPosts variable from the outer scope. This allows you to
use it from within the closure.

Dynamic Routing
Now, you can create another controller for viewing individual blog posts:

Listing 2-8 1 $app->get('/blog/{id}', function (Silex\Application $app, $id) use ($blogPosts) {

2 if (!isset($blogPosts[$id])) {
3 $app->abort(404, "Post $id does not exist.");
4 }
5
6 $post = $blogPosts[$id];
7
8 return "<h1>{$post['title']}</h1>".
9 "<p>{$post['body']}</p>";
10 });

This route definition has a variable {id} part which is passed to the closure.
The current Application is automatically injected by Silex to the Closure thanks to the type hinting.
When the post does not exist, you are using abort() to stop the request early. It actually throws an
exception, which you will see how to handle later on.

Example POST Route

POST routes signify the creation of a resource. An example for this is a feedback form. You will use the
mail function to send an e-mail:
Listing 2-9 1 use Symfony\Component\HttpFoundation\Request;
2 use Symfony\Component\HttpFoundation\Response;
3
4 $app->post('/feedback', function (Request $request) {
5 $message = $request->get('message');
6 mail('[email protected]', '[YourSite] Feedback', $message);
7
8 return new Response('Thank you for your feedback!', 201);
9 });

It is pretty straightforward.

There is a SwiftmailerServiceProvider included that you can use instead of mail().

The current request is automatically injected by Silex to the Closure thanks to the type hinting. It is an
instance of Request3, so you can fetch variables using the request get method.
Instead of returning a string you are returning an instance of Response4. This allows setting an HTTP
status code, in this case it is set to 201 Created.

Silex always uses a Response internally, it converts strings to responses with status code 200.

3. https://api.symfony.com/master/Symfony/Component/HttpFoundation/Request.html
4. https://api.symfony.com/master/Symfony/Component/HttpFoundation/Response.html

PDF brought to you by Chapter 2: Usage | 9

generated on April 10, 2019

 Other methods
You can create controllers for most HTTP methods. Just call one of these methods on your application:
get, post, put, delete, patch, options:
Listing 2-10 1 $app->put('/blog/{id}', function ($id) {
2 // ...
3 });
4
5 $app->delete('/blog/{id}', function ($id) {
6 // ...
7 });
8
9 $app->patch('/blog/{id}', function ($id) {
10 // ...
11 });

Forms in most web browsers do not directly support the use of other HTTP methods. To use
methods other than GET and POST you can utilize a special form field with a name of _method.
The form's method attribute must be set to POST when using this field:

Listing 2-11 1 <form action="/my/target/route/" method="post">

2 <!-- ... -->
3 <input type="hidden" id="_method" name="_method" value="PUT" />
4 </form>

You need to explicitly enable this method override:

use Symfony\Component\HttpFoundation\Request;
Listing 2-12

Request::enableHttpMethodParameterOverride();
$app->run();

You can also call match, which will match all methods. This can be restricted via the method method:

Listing 2-13 1 $app->match('/blog', function () {

2 // ...
3 });
4
5 $app->match('/blog', function () {
6 // ...
7 })
8 ->method('PATCH');
9
10 $app->match('/blog', function () {
11 // ...
12 })
13 ->method('PUT|POST');

The order in which the routes are defined is significant. The first matching route will be used, so
place more generic routes at the bottom.

Route Variables
As it has been shown before you can define variable parts in a route like this:

Listing 2-14
$app->get('/blog/{id}', function ($id) {
// ...
});

PDF brought to you by Chapter 2: Usage | 10

generated on April 10, 2019

 It is also possible to have more than one variable part, just make sure the closure arguments match the
names of the variable parts:

Listing 2-15
$app->get('/blog/{postId}/{commentId}', function ($postId, $commentId) {
// ...
});

While it's not recommended, you could also do this (note the switched arguments):

Listing 2-16
$app->get('/blog/{postId}/{commentId}', function ($commentId, $postId) {
// ...
});

You can also ask for the current Request and Application objects:

Listing 2-17
$app->get('/blog/{id}', function (Application $app, Request $request, $id) {
// ...
});

Note for the Application and Request objects, Silex does the injection based on the type hinting and
not on the variable name:
$app->get('/blog/{id}', function (Application $foo, Request $bar, $id) {
Listing 2-18
// ...
});

Route Variable Converters

Before injecting the route variables into the controller, you can apply some converters:

Listing 2-19
$app->get('/user/{id}', function ($id) {
// ...
})->convert('id', function ($id) { return (int) $id; });

This is useful when you want to convert route variables to objects as it allows to reuse the conversion
code across different controllers:

Listing 2-20 1 $userProvider = function ($id) {

2 return new User($id);
3 };
4
5 $app->get('/user/{user}', function (User $user) {
6 // ...
7 })->convert('user', $userProvider);
8
9 $app->get('/user/{user}/edit', function (User $user) {
10 // ...
11 })->convert('user', $userProvider);

The converter callback also receives the Request as its second argument:

Listing 2-21 1 $callback = function ($post, Request $request) {

2 return new Post($request->attributes->get('slug'));
3 };
4
5 $app->get('/blog/{id}/{slug}', function (Post $post) {
6 // ...
7 })->convert('post', $callback);

A converter can also be defined as a service. For example, here is a user converter based on Doctrine
ObjectManager:

Listing 2-22

PDF brought to you by Chapter 2: Usage | 11

generated on April 10, 2019

 1 use Doctrine\Common\Persistence\ObjectManager;
2 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
3
4 class UserConverter
5 {
6 private $om;
7
8 public function __construct(ObjectManager $om)
9 {
10 $this->om = $om;
11 }
12
13 public function convert($id)
14 {
15 if (null === $user = $this->om->find('User', (int) $id)) {
16 throw new NotFoundHttpException(sprintf('User %d does not exist', $id));
17 }
18
19 return $user;
20 }
21 }

The service will now be registered in the application, and the convert() method will be used as
converter (using the syntax service_name:method_name):

Listing 2-23 1 $app['converter.user'] = function () {

2 return new UserConverter();
3 };
4
5 $app->get('/user/{user}', function (User $user) {
6 // ...
7 })->convert('user', 'converter.user:convert');

Requirements
In some cases you may want to only match certain expressions. You can define requirements using
regular expressions by calling assert on the Controller object, which is returned by the routing
methods.
The following will make sure the id argument is a positive integer, since \d+ matches any amount of
digits:

Listing 2-24
$app->get('/blog/{id}', function ($id) {
// ...
})
->assert('id', '\d+');

You can also chain these calls:

Listing 2-25 1 $app->get('/blog/{postId}/{commentId}', function ($postId, $commentId) {

2 // ...
3 })
4 ->assert('postId', '\d+')
5 ->assert('commentId', '\d+');

Conditions
Besides restricting route matching based on the HTTP method or parameter requirements, you can set
conditions on any part of the request by calling when on the Controller object, which is returned by
the routing methods:

Listing 2-26
$app->get('/blog/{id}', function ($id) {
// ...

PDF brought to you by Chapter 2: Usage | 12

generated on April 10, 2019

 })
->when("request.headers.get('User-Agent') matches '/firefox/i'");

The when argument is a Symfony Expression5 , which means that you need to add symfony/
expression-language as a dependency of your project.

Default Values
You can define a default value for any route variable by calling value on the Controller object:

Listing 2-27
$app->get('/{pageName}', function ($pageName) {
// ...
})
->value('pageName', 'index');

This will allow matching /, in which case the pageName variable will have the value index.

Named Routes
Some providers can make use of named routes. By default Silex will generate an internal route name for
you but you can give an explicit route name by calling bind:

Listing 2-28 1 $app->get('/', function () {

2 // ...
3 })
4 ->bind('homepage');
5
6 $app->get('/blog/{id}', function ($id) {
7 // ...
8 })
9 ->bind('blog_post');

Controllers as Classes
Instead of anonymous functions, you can also define your controllers as methods. By using the
ControllerClass::methodName syntax, you can tell Silex to lazily create the controller object for
you:

Listing 2-29 1 $app->get('/', 'Acme\\Foo::bar');

2
3 use Silex\Application;
4 use Symfony\Component\HttpFoundation\Request;
5
6 namespace Acme
7 {
8 class Foo
9 {
10 public function bar(Request $request, Application $app)
11 {
12 // ...
13 }
14 }
15 }

This will load the Acme\Foo class on demand, create an instance and call the bar method to get the
response. You can use Request and Silex\Application type hints to get $request and $app
injected.
It is also possible to define your controllers as services.

5. https://symfony.com/doc/current/book/routing.html#completely-customized-route-matching-with-conditions

PDF brought to you by Chapter 2: Usage | 13

generated on April 10, 2019

 Global Configuration
If a controller setting must be applied to all controllers (a converter, a middleware, a requirement, or a
default value), configure it on $app['controllers'], which holds all application controllers:

Listing 2-30 1 $app['controllers']

2 ->value('id', '1')
3 ->assert('id', '\d+')
4 ->requireHttps()
5 ->method('get')
6 ->convert('id', function () { /* ... */ })
7 ->before(function () { /* ... */ })
8 ->when('request.isSecure() == true')
9 ;

These settings are applied to already registered controllers and they become the defaults for new
controllers.

The global configuration does not apply to controller providers you might mount as they have their
own global configuration (read the dedicated chapter for more information).

Error Handlers
When an exception is thrown, error handlers allow you to display a custom error page to the user. They
can also be used to do additional things, such as logging.
To register an error handler, pass a closure to the error method which takes an Exception argument
and returns a response:

Listing 2-31 1 use Symfony\Component\HttpFoundation\Response;

2 use Symfony\Component\HttpFoundation\Request;
3
4 $app->error(function (\Exception $e, Request $request, $code) {
5 return new Response('We are sorry, but something went terribly wrong.');
6 });

You can also check for specific errors by using the $code argument, and handle them differently:

Listing 2-32 1 use Symfony\Component\HttpFoundation\Response;

2 use Symfony\Component\HttpFoundation\Request;
3
4 $app->error(function (\Exception $e, Request $request, $code) {
5 switch ($code) {
6 case 404:
7 $message = 'The requested page could not be found.';
8 break;
9 default:
10 $message = 'We are sorry, but something went terribly wrong.';
11 }
12
13 return new Response($message);
14 });

You can restrict an error handler to only handle some Exception classes by setting a more specific type
hint for the Closure argument:

Listing 2-33 1 use Symfony\Component\HttpFoundation\Request;

2
3 $app->error(function (\LogicException $e, Request $request, $code) {

PDF brought to you by Chapter 2: Usage | 14

generated on April 10, 2019

 4 // this handler will only handle \LogicException exceptions
5 // and exceptions that extend \LogicException
6 });

As Silex ensures that the Response status code is set to the most appropriate one depending on the
exception, setting the status on the response alone won't work.
If you want to overwrite the status code, which you should not without a good reason, set the X-
Status-Code header (on Symfony until version 3.2):
return new Response('Error', 404 /* ignored */, array('X-Status-Code' => 200));
Listing 2-34

As of Symfony 3.3, call GetResponseForExceptionEvent::allowCustomResponseCode()

first and then then set the status code on the response as normal. The kernel will now use your status
code when sending the response to the client. The GetResponseForExceptionEvent is passed
to the error callback as a 4th parameter:

Listing 2-35 1 use Symfony\Component\HttpFoundation\Response;

2 use Symfony\Component\HttpFoundation\Request;
3 use Symfony\Component\HttpKernel\Event\GetResponseForExceptionEvent;
4
5 $app->error(function (\Exception $e, Request $request, $code, GetResponseForExceptionEvent $event) {
6 $event->allowCustomResponseCode();
7 $response = new Response('No Content', 204);
8
9 return $response;
10 });

If you want to use a separate error handler for logging, make sure you register it with a higher priority
than response error handlers, because once a response is returned, the following handlers are ignored.

Silex ships with a provider for Monolog6 which handles logging of errors. Check out the Providers
chapter for details.

Silex comes with a default error handler that displays a detailed error message with the stack
trace when debug is true, and a simple error message otherwise. Error handlers registered via the
error() method always take precedence but you can keep the nice error messages when debug is
turned on like this:

Listing 2-36 1 use Symfony\Component\HttpFoundation\Response;

2 use Symfony\Component\HttpFoundation\Request;
3
4 $app->error(function (\Exception $e, Request $request, $code) use ($app) {
5 if ($app['debug']) {
6 return;
7 }
8
9 // ... logic to handle the error and return a Response
10 });

The error handlers are also called when you use abort to abort a request early:

Listing 2-37 1 $app->get('/blog/{id}', function (Silex\Application $app, $id) use ($blogPosts) {

2 if (!isset($blogPosts[$id])) {
3 $app->abort(404, "Post $id does not exist.");
4 }

6. https://github.com/Seldaek/monolog

PDF brought to you by Chapter 2: Usage | 15

generated on April 10, 2019

 5
6 return new Response(...);
7 });

You can convert errors to Exceptions, check out the cookbook chapter for details.

View Handlers
View Handlers allow you to intercept a controller result that is not a Response and transform it before
it gets returned to the kernel.
To register a view handler, pass a callable (or string that can be resolved to a callable) to the view()
method. The callable should accept some sort of result from the controller:

Listing 2-38
$app->view(function (array $controllerResult) use ($app) {
return $app->json($controllerResult);
});

View Handlers also receive the Request as their second argument, making them a good candidate for
basic content negotiation:

Listing 2-39 1 $app->view(function (array $controllerResult, Request $request) use ($app) {

2 $acceptHeader = $request->headers->get('Accept');
3 $bestFormat = $app['negotiator']->getBestFormat($acceptHeader, array('json', 'xml'));
4
5 if ('json' === $bestFormat) {
6 return new JsonResponse($controllerResult);
7 }
8
9 if ('xml' === $bestFormat) {
10 return $app['serializer.xml']->renderResponse($controllerResult);
11 }
12
13 return $controllerResult;
14 });

View Handlers will be examined in the order they are added to the application and Silex will use type
hints to determine if a view handler should be used for the current result, continuously using the return
value of the last view handler as the input for the next.

You must ensure that Silex receives a Response or a string as the result of the last view handler (or
controller) to be run.

Redirects
You can redirect to another page by returning a RedirectResponse response, which you can create by
calling the redirect method:

Listing 2-40
$app->get('/', function () use ($app) {
return $app->redirect('/hello');
});

This will redirect from / to /hello.

PDF brought to you by Chapter 2: Usage | 16

generated on April 10, 2019

 Forwards
When you want to delegate the rendering to another controller, without a round-trip to the browser (as
for a redirect), use an internal sub-request:

Listing 2-41 1 use Symfony\Component\HttpFoundation\Request;

2 use Symfony\Component\HttpKernel\HttpKernelInterface;
3
4 $app->get('/', function () use ($app) {
5 // forward to /hello
6 $subRequest = Request::create('/hello', 'GET');
7
8 return $app->handle($subRequest, HttpKernelInterface::SUB_REQUEST);
9 });

You can also generate the URI via the built-in URL generator:
$request = Request::create($app['url_generator']->generate('hello'), 'GET');
Listing 2-42

There's some more things that you need to keep in mind though. In most cases you will want to forward
some parts of the current master request to the sub-request. That includes: Cookies, server information,
session. Read more on how to make sub-requests.

JSON
If you want to return JSON data, you can use the json helper method. Simply pass it your data, status
code and headers, and it will create a JSON response for you:

Listing 2-43 1 $app->get('/users/{id}', function ($id) use ($app) {

2 $user = getUser($id);
3
4 if (!$user) {
5 $error = array('message' => 'The user was not found.');
6
7 return $app->json($error, 404);
8 }
9
10 return $app->json($user);
11 });

Streaming
It's possible to stream a response, which is important in cases when you don't want to buffer the data
being sent:

Listing 2-44 1 $app->get('/images/{file}', function ($file) use ($app) {

2 if (!file_exists(__DIR__.'/images/'.$file)) {
3 return $app->abort(404, 'The image was not found.');
4 }
5
6 $stream = function () use ($file) {
7 readfile($file);
8 };
9
10 return $app->stream($stream, 200, array('Content-Type' => 'image/png'));
11 });

PDF brought to you by Chapter 2: Usage | 17

generated on April 10, 2019

 If you need to send chunks, make sure you call ob_flush and flush after every chunk:

Listing 2-45 1 $stream = function () {

2 $fh = fopen('http://www.example.com/', 'rb');
3 while (!feof($fh)) {
4 echo fread($fh, 1024);
5 ob_flush();
6 flush();
7 }
8 fclose($fh);
9 };

Sending a file
If you want to return a file, you can use the sendFile helper method. It eases returning files that would
otherwise not be publicly available. Simply pass it your file path, status code, headers and the content
disposition and it will create a BinaryFileResponse response for you:

Listing 2-46 1 $app->get('/files/{path}', function ($path) use ($app) {

2 if (!file_exists('/base/path/' . $path)) {
3 $app->abort(404);
4 }
5
6 return $app->sendFile('/base/path/' . $path);
7 });

To further customize the response before returning it, check the API doc for
SymfonyComponentHttpFoundationBinaryFileResponse7:

Listing 2-47
return $app
->sendFile('/base/path/' . $path)
->setContentDisposition(ResponseHeaderBag::DISPOSITION_ATTACHMENT, 'pic.jpg')
;

Traits
Silex comes with PHP traits that define shortcut methods.
Almost all built-in service providers have some corresponding PHP traits. To use them, define your own
Application class and include the traits you want:

Listing 2-48 1 use Silex\Application;

2
3 class MyApplication extends Application
4 {
5 use Application\TwigTrait;
6 use Application\SecurityTrait;
7 use Application\FormTrait;
8 use Application\UrlGeneratorTrait;
9 use Application\SwiftmailerTrait;
10 use Application\MonologTrait;
11 use Application\TranslationTrait;
12 }

You can also define your own Route class and use some traits:

Listing 2-49 1 use Silex\Route;

2

7. https://api.symfony.com/master/Symfony/Component/HttpFoundation/BinaryFileResponse.html

PDF brought to you by Chapter 2: Usage | 18

generated on April 10, 2019

 3 class MyRoute extends Route
4 {
5 use Route\SecurityTrait;
6 }

To use your newly defined route, override the $app['route_class'] setting:

Listing 2-50
$app['route_class'] = 'MyRoute';

Read each provider chapter to learn more about the added methods.

Security
Make sure to protect your application against attacks.

Escaping
When outputting any user input, make sure to escape it correctly to prevent Cross-Site-Scripting attacks.

• Escaping HTML: PHP provides the htmlspecialchars function for this. Silex provides a
shortcut escape method:

Listing 2-51 1 use Symfony\Component\HttpFoundation\Request;

2
3 $app->get('/name', function (Request $request, Silex\Application $app) {
4 $name = $request->get('name');
5
6 return "You provided the name {$app->escape($name)}.";
7 });

If you use the Twig template engine, you should use its escaping or even auto-escaping mechanisms.
Check out the Providers chapter for details.
• Escaping JSON: If you want to provide data in JSON format you should use the Silex json
function:

Listing 2-52 1 use Symfony\Component\HttpFoundation\Request;

2
3 $app->get('/name.json', function (Request $request, Silex\Application $app) {
4 $name = $request->get('name');
5
6 return $app->json(array('name' => $name));
7 });

PDF brought to you by Chapter 2: Usage | 19

generated on April 10, 2019

 Chapter 3
Middleware

Silex allows you to run code, that changes the default Silex behavior, at different stages during the
handling of a request through middleware:

• Application middleware is triggered independently of the current handled request;

• Route middleware is triggered when its associated route is matched.

Application Middleware
Application middleware is only run for the "master" Request.

Before Middleware
A before application middleware allows you to tweak the Request before the controller is executed:

Listing 3-1
$app->before(function (Request $request, Application $app) {
// ...
});

By default, the middleware is run after the routing and the security.
If you want your middleware to be run even if an exception is thrown early on (on a 404 or 403 error for
instance), then, you need to register it as an early event:

Listing 3-2
$app->before(function (Request $request, Application $app) {
// ...
}, Application::EARLY_EVENT);

In this case, the routing and the security won't have been executed, and so you won't have access to the
locale, the current route, or the security user.

The before middleware is an event registered on the Symfony request event.

PDF brought to you by Chapter 3: Middleware | 20

generated on April 10, 2019

 After Middleware
An after application middleware allows you to tweak the Response before it is sent to the client:

Listing 3-3
$app->after(function (Request $request, Response $response) {
// ...
});

The after middleware is an event registered on the Symfony response event.

Finish Middleware
A finish application middleware allows you to execute tasks after the Response has been sent to the client
(like sending emails or logging):

Listing 3-4
$app->finish(function (Request $request, Response $response) {
// ...
// Warning: modifications to the Request or Response will be ignored
});

The finish middleware is an event registered on the Symfony terminate event.

Route Middleware
Route middleware is added to routes or route collections and it is only triggered when the corresponding
route is matched. You can also stack them:

Listing 3-5 1 $app->get('/somewhere', function () {

2 // ...
3 })
4 ->before($before1)
5 ->before($before2)
6 ->after($after1)
7 ->after($after2)
8 ;

Before Middleware
A before route middleware is fired just before the route callback, but after the before application
middleware:

Listing 3-6 1 $before = function (Request $request, Application $app) {

2 // ...
3 };
4
5 $app->get('/somewhere', function () {
6 // ...
7 })
8 ->before($before);

PDF brought to you by Chapter 3: Middleware | 21

generated on April 10, 2019

 After Middleware
An after route middleware is fired just after the route callback, but before the application after application
middleware:

Listing 3-7 1 $after = function (Request $request, Response $response, Application $app) {
2 // ...
3 };
4
5 $app->get('/somewhere', function () {
6 // ...
7 })
8 ->after($after);

Middleware Priority
You can add as much middleware as you want, in which case they are triggered in the same order as you
added them.
You can explicitly control the priority of your middleware by passing an additional argument to the
registration methods:

Listing 3-8
$app->before(function (Request $request) {
// ...
}, 32);

As a convenience, two constants allow you to register an event as early as possible or as late as possible:

Listing 3-9 1 $app->before(function (Request $request) {

2 // ...
3 }, Application::EARLY_EVENT);
4
5 $app->before(function (Request $request) {
6 // ...
7 }, Application::LATE_EVENT);

Short-circuiting the Controller

If a before middleware returns a Response object, the request handling is short-circuited (the next
middleware won't be run, nor the route callback), and the Response is passed to the after middleware
right away:

Listing 3-10 1 $app->before(function (Request $request) {

2 // redirect the user to the login screen if access to the Resource is protected
3 if (...) {
4 return new RedirectResponse('/login');
5 }
6 });

A RuntimeException is thrown if a before middleware does not return a Response or null.

PDF brought to you by Chapter 3: Middleware | 22

generated on April 10, 2019

 Chapter 4
Organizing Controllers

When your application starts to define too many controllers, you might want to group them logically:

Listing 4-1 1 // define controllers for a blog

2 $blog = $app['controllers_factory'];
3 $blog->get('/', function () {
4 return 'Blog home page';
5 });
6 // ...
7
8 // define controllers for a forum
9 $forum = $app['controllers_factory'];
10 $forum->get('/', function () {
11 return 'Forum home page';
12 });
13
14 // define "global" controllers
15 $app->get('/', function () {
16 return 'Main home page';
17 });
18
19 $app->mount('/blog', $blog);
20 $app->mount('/forum', $forum);
21
22 // define controllers for an admin
23 $app->mount('/admin', function ($admin) {
24 // recursively mount
25 $admin->mount('/blog', function ($user) {
26 $user->get('/', function () {
27 return 'Admin Blog home page';
28 });
29 });
30 });

$app['controllers_factory'] is a factory that returns a new instance of

ControllerCollection when used.

mount() prefixes all routes with the given prefix and merges them into the main Application. So, / will
map to the main home page, /blog/ to the blog home page, /forum/ to the forum home page, and
/admin/blog/ to the admin blog home page.

PDF brought to you by Chapter 4: Organizing Controllers | 23

generated on April 10, 2019

 When mounting a route collection under /blog, it is not possible to define a route for the /blog
URL. The shortest possible URL is /blog/.

When calling get(), match(), or any other HTTP methods on the Application, you are in
fact calling them on a default instance of ControllerCollection (stored in
$app['controllers']).

Another benefit is the ability to apply settings on a set of controllers very easily. Building on the example
from the middleware section, here is how you would secure all controllers for the backend collection:

Listing 4-2
$backend = $app['controllers_factory'];

// ensure that all controllers require logged-in users

$backend->before($mustBeLogged);

For a better readability, you can split each controller collection into a separate file:

Listing 4-3 1 // blog.php

2 $blog = $app['controllers_factory'];
3 $blog->get('/', function () { return 'Blog home page'; });
4
5 return $blog;
6
7 // app.php
8 $app->mount('/blog', include 'blog.php');

Instead of requiring a file, you can also create a Controller provider.

PDF brought to you by Chapter 4: Organizing Controllers | 24

generated on April 10, 2019

 Chapter 5
Services

Silex is not only a framework, it is also a service container. It does this by extending Pimple1 which
provides a very simple service container.

Dependency Injection
You can skip this if you already know what Dependency Injection is.

Dependency Injection is a design pattern where you pass dependencies to services instead of creating
them from within the service or relying on globals. This generally leads to code that is decoupled, re-
usable, flexible and testable.
Here is an example of a class that takes a User object and stores it as a file in JSON format:

Listing 5-1 1 class JsonUserPersister

2 {
3 private $basePath;
4
5 public function __construct($basePath)
6 {
7 $this->basePath = $basePath;
8 }
9
10 public function persist(User $user)
11 {
12 $data = $user->getAttributes();
13 $json = json_encode($data);
14 $filename = $this->basePath.'/'.$user->id.'.json';
15 file_put_contents($filename, $json, LOCK_EX);
16 }
17 }

1. https://pimple.symfony.com

PDF brought to you by Chapter 5: Services | 25

generated on April 10, 2019

 In this simple example the dependency is the basePath property. It is passed to the constructor. This
means you can create several independent instances with different base paths. Of course dependencies
do not have to be simple strings. More often they are in fact other services.
A service container is responsible for creating and storing services. It can recursively create dependencies
of the requested services and inject them. It does so lazily, which means a service is only created when
you actually need it.

Pimple
Pimple makes strong use of closures and implements the ArrayAccess interface.
We will start off by creating a new instance of Pimple -- and because Silex\Application extends
Pimple\Container all of this applies to Silex as well:
Listing 5-2
$container = new Pimple\Container();

or:

Listing 5-3
$app = new Silex\Application();

Parameters
You can set parameters (which are usually strings) by setting an array key on the container:

Listing 5-4
$app['some_parameter'] = 'value';

The array key can be any value. By convention dots are used for namespacing:

Listing 5-5
$app['asset.host'] = 'http://cdn.mysite.com/';

Reading parameter values is possible with the same syntax:

Listing 5-6
echo $app['some_parameter'];

Service definitions
Defining services is no different than defining parameters. You just set an array key on the container to
be a closure. However, when you retrieve the service, the closure is executed. This allows for lazy service
creation:

Listing 5-7
$app['some_service'] = function () {
return new Service();
};

And to retrieve the service, use:

Listing 5-8
$service = $app['some_service'];

On first invocation, this will create the service; the same instance will then be returned on any subsequent
access.

Factory services
If you want a different instance to be returned for each service access, wrap the service definition with the
factory() method:
Listing 5-9
$app['some_service'] = $app->factory(function () {
return new Service();
});

PDF brought to you by Chapter 5: Services | 26

generated on April 10, 2019

 Every time you call $app['some_service'], a new instance of the service is created.

Access container from closure

In many cases you will want to access the service container from within a service definition closure. For
example when fetching services the current service depends on.
Because of this, the container is passed to the closure as an argument:

Listing 5-10
$app['some_service'] = function ($app) {
return new Service($app['some_other_service'], $app['some_service.config']);
};

Here you can see an example of Dependency Injection. some_service depends on

some_other_service and takes some_service.config as configuration options. The dependency
is only created when some_service is accessed, and it is possible to replace either of the dependencies
by simply overriding those definitions.
Going back to our initial example, here's how we could use the container to manage its dependencies:

Listing 5-11
$app['user.persist_path'] = '/tmp/users';
$app['user.persister'] = function ($app) {
return new JsonUserPersister($app['user.persist_path']);
};

Protected closures
Because the container sees closures as factories for services, it will always execute them when reading
them.
In some cases you will however want to store a closure as a parameter, so that you can fetch it and execute
it yourself -- with your own arguments.
This is why Pimple allows you to protect your closures from being executed, by using the protect
method:

Listing 5-12 1 $app['closure_parameter'] = $app->protect(function ($a, $b) {

2 return $a + $b;
3 });
4
5 // will not execute the closure
6 $add = $app['closure_parameter'];
7
8 // calling it now
9 echo $add(2, 3);

Note that the container is not provided as an argument to protected closures. However, you can inject it
via use($app):

Listing 5-13
$app['closure_parameter'] = $app->protect(function ($a, $b) use ($app) {
// ...
});

Modify services after definition

Sometimes you want to alter a service after its definition. Pimple facilitates this by extending the already
defined service.
First argument of the extend method is the name of the service you want to modify. Second argument
is a callable. This callable is executed with the service you want to alter as its first argument, the service
container itself is provided in the second argument.

PDF brought to you by Chapter 5: Services | 27

generated on April 10, 2019

 Be sure to return the modified service in the callable.

You can use this pattern to add functionality to :doc:Twig <providers/twig> for example:

Listing 5-14 1 $app->extend('twig', function($twig, $app) {

2 $twig->addGlobal('pi', 3.14);
3 $twig->addFilter('levenshtein', new \Twig_Filter_Function('levenshtein'));
4
5 return $twig;
6 });

Core services
Silex defines a range of services.

• request_stack: Controls the lifecycle of requests, an instance of RequestStack2. It gives you access
to GET, POST parameters and lots more!
Example usage:

Listing 5-15
$id = $app['request_stack']->getCurrentRequest()->get('id');

A request is only available when a request is being served; you can only access it from within a
controller, an application before/after middlewares, or an error handler.
• routes: The RouteCollection3 that is used internally. You can add, modify, read routes.
• url_generator: An instance of UrlGenerator4, using the RouteCollection5 that is provided through
the routes service. It has a generate method, which takes the route name as an argument,
followed by an array of route parameters.
• controllers: The Silex\ControllerCollection that is used internally. Check the Internals
chapter for more information.
• dispatcher: The EventDispatcher6 that is used internally. It is the core of the Symfony system and is
used quite a bit by Silex.
• resolver: The ControllerResolver7 that is used internally. It takes care of executing the controller
with the right arguments.
• kernel: The HttpKernel8 that is used internally. The HttpKernel is the heart of Symfony, it takes a
Request as input and returns a Response as output.
• request_context: The request context is a simplified representation of the request that is used by
the router and the URL generator.
• exception_handler: The Exception handler is the default handler that is used when you don't
register one via the error() method or if your handler does not return a Response. Disable it with
unset($app['exception_handler']).

2. https://api.symfony.com/master/Symfony/Component/HttpFoundation/RequestStack.html
3. https://api.symfony.com/master/Symfony/Component/Routing/RouteCollection.html
4. https://api.symfony.com/master/Symfony/Component/Routing/Generator/UrlGenerator.html
5. https://api.symfony.com/master/Symfony/Component/Routing/RouteCollection.html
6. https://api.symfony.com/master/Symfony/Component/EventDispatcher/EventDispatcher.html
7. https://api.symfony.com/master/Symfony/Component/HttpKernel/Controller/ControllerResolver.html
8. https://api.symfony.com/master/Symfony/Component/HttpKernel/HttpKernel.html

PDF brought to you by Chapter 5: Services | 28

generated on April 10, 2019

 • logger: A LoggerInterface9 instance. By default, logging is disabled as the value is set to null. To
enable logging you can either use the MonologServiceProvider or define your own logger service
that conforms to the PSR logger interface.

Core traits
• Silex\Application\UrlGeneratorTrait adds the following shortcuts:

• path: Generates a path.

• url: Generates an absolute URL.

Listing 5-16 1 $app->path('homepage');

2 $app->url('homepage');

Core parameters
• request.http_port (optional): Allows you to override the default port for non-HTTPS URLs. If the
current request is HTTP, it will always use the current port.
Defaults to 80.
This parameter can be used when generating URLs.
• request.https_port (optional): Allows you to override the default port for HTTPS URLs. If the
current request is HTTPS, it will always use the current port.
Defaults to 443.
This parameter can be used when generating URLs.
• debug (optional): Returns whether or not the application is running in debug mode.
Defaults to false.
• charset (optional): The charset to use for Responses.
Defaults to UTF-8.

9. https://github.com/php-fig/log/blob/master/Psr/Log/LoggerInterface.php

PDF brought to you by Chapter 5: Services | 29

generated on April 10, 2019

 Chapter 6
Providers

Providers allow the developer to reuse parts of an application into another one. Silex provides two
types of providers defined by two interfaces: ServiceProviderInterface for services and
ControllerProviderInterface for controllers.

Service Providers
Loading providers
In order to load and use a service provider, you must register it on the application:

Listing 6-1
$app = new Silex\Application();

$app->register(new Acme\DatabaseServiceProvider());

You can also provide some parameters as a second argument. These will be set after the provider is
registered, but before it is booted:

Listing 6-2 1 $app->register(new Acme\DatabaseServiceProvider(), array(

2 'database.dsn' => 'mysql:host=localhost;dbname=myapp',
3 'database.user' => 'root',
4 'database.password' => 'secret_root_password',
5 ));

Conventions
You need to watch out in what order you do certain things when interacting with providers. Just keep
these rules in mind:

• Overriding existing services must occur after the provider is registered.

Reason: If the service already exists, the provider will overwrite it.
• You can set parameters any time after the provider is registered, but before the service is accessed.
Reason: Providers can set default values for parameters. Just like with services, the provider will
overwrite existing values.

PDF brought to you by Chapter 6: Providers | 30

generated on April 10, 2019

 Included providers
There are a few providers that you get out of the box. All of these are within the Silex\Provider
namespace:

• AssetServiceProvider
• CsrfServiceProvider
• DoctrineServiceProvider
• FormServiceProvider
• HttpCacheServiceProvider
• HttpFragmentServiceProvider
• LocaleServiceProvider
• MonologServiceProvider
• RememberMeServiceProvider
• SecurityServiceProvider
• SerializerServiceProvider
• ServiceControllerServiceProvider
• SessionServiceProvider
• SwiftmailerServiceProvider
• TranslationServiceProvider
• TwigServiceProvider
• ValidatorServiceProvider
• VarDumperServiceProvider

The Silex core team maintains a WebProfiler1 provider that helps debug code in the development
environment thanks to the Symfony web debug toolbar and the Symfony profiler.

Third party providers

Some service providers are developed by the community. Those third-party providers are listed on Silex'
repository wiki2.
You are encouraged to share yours.

Creating a provider
Providers must implement the Pimple\ServiceProviderInterface:

Listing 6-3
interface ServiceProviderInterface
{
public function register(Container $container);
}

This is very straight forward, just create a new class that implements the register method. In the
register() method, you can define services on the application which then may make use of other
services and parameters.

The Pimple\ServiceProviderInterface belongs to the Pimple package, so take care to only

use the API of Pimple\Container within your register method. Not only is this a good
practice due to the way Pimple and Silex work, but may allow your provider to be used outside of
Silex.

1. https://github.com/silexphp/Silex-WebProfiler
2. https://github.com/silexphp/Silex/wiki/Third-Party-ServiceProviders-for-Silex-2.x

PDF brought to you by Chapter 6: Providers | 31

generated on April 10, 2019

 Optionally, your service provider can implement the Silex\Api\BootableProviderInterface. A
bootable provider must implement the boot() method, with which you can configure the application,
just before it handles a request:

Listing 6-4
interface BootableProviderInterface
{
function boot(Application $app);
}

Another optional interface, is the Silex\Api\EventListenerProviderInterface. This interface

contains the subscribe() method, which allows your provider to subscribe event listener with Silex's
EventDispatcher, just before it handles a request:

Listing 6-5
interface EventListenerProviderInterface
{
function subscribe(Container $app, EventDispatcherInterface $dispatcher);
}

Here is an example of such a provider:

Listing 6-6 1 namespace Acme;

2
3 use Pimple\Container;
4 use Pimple\ServiceProviderInterface;
5 use Silex\Application;
6 use Silex\Api\BootableProviderInterface;
7 use Silex\Api\EventListenerProviderInterface;
8 use Symfony\Component\EventDispatcher\EventDispatcherInterface;
9 use Symfony\Component\HttpKernel\KernelEvents;
10 use Symfony\Component\HttpKernel\Event\FilterResponseEvent;
11
12 class HelloServiceProvider implements ServiceProviderInterface, BootableProviderInterface,
13 EventListenerProviderInterface
14 {
15 public function register(Container $app)
16 {
17 $app['hello'] = $app->protect(function ($name) use ($app) {
18 $default = $app['hello.default_name'] ? $app['hello.default_name'] : '';
19 $name = $name ?: $default;
20
21 return 'Hello '.$app->escape($name);
22 });
23 }
24
25 public function boot(Application $app)
26 {
27 // do something
28 }
29
30 public function subscribe(Container $app, EventDispatcherInterface $dispatcher)
31 {
32 $dispatcher->addListener(KernelEvents::REQUEST, function(FilterResponseEvent $event) use ($app) {
33 // do something
34 });
35 }
}

This class provides a hello service which is a protected closure. It takes a name argument and will return
hello.default_name if no name is given. If the default is also missing, it will use an empty string.
You can now use this provider as follows:

Listing 6-7 1 use Symfony\Component\HttpFoundation\Request;

2
3 $app = new Silex\Application();
4
5 $app->register(new Acme\HelloServiceProvider(), array(
6 'hello.default_name' => 'Igor',

PDF brought to you by Chapter 6: Providers | 32

generated on April 10, 2019

 7 ));
8
9 $app->get('/hello', function (Request $request) use ($app) {
10 $name = $request->get('name');
11
12 return $app['hello']($name);
13 });

In this example we are getting the name parameter from the query string, so the request path would have
to be /hello?name=Fabien.

Controller Providers
Loading providers
In order to load and use a controller provider, you must "mount" its controllers under a path:

Listing 6-8
$app = new Silex\Application();

$app->mount('/blog', new Acme\BlogControllerProvider());

All controllers defined by the provider will now be available under the /blog path.

Creating a provider
Providers must implement the Silex\Api\ControllerProviderInterface:

Listing 6-9
interface ControllerProviderInterface
{
public function connect(Application $app);
}

Here is an example of such a provider:

Listing 6-10 1 namespace Acme;

2
3 use Silex\Application;
4 use Silex\Api\ControllerProviderInterface;
5
6 class HelloControllerProvider implements ControllerProviderInterface
7 {
8 public function connect(Application $app)
9 {
10 // creates a new controller based on the default route
11 $controllers = $app['controllers_factory'];
12
13 $controllers->get('/', function (Application $app) {
14 return $app->redirect('/hello');
15 });
16
17 return $controllers;
18 }
19 }

The connect method must return an instance of ControllerCollection.

ControllerCollection is the class where all controller related methods are defined (like get, post,
match, ...).

PDF brought to you by Chapter 6: Providers | 33

generated on April 10, 2019

 The Application class acts in fact as a proxy for these methods.

You can use this provider as follows:

Listing 6-11
$app = new Silex\Application();

$app->mount('/blog', new Acme\HelloControllerProvider());

In this example, the /blog/ path now references the controller defined in the provider.

You can also define a provider that implements both the service and the controller provider interface
and package in the same class the services needed to make your controllers work.

PDF brought to you by Chapter 6: Providers | 34

generated on April 10, 2019

 Chapter 7
Testing

Because Silex is built on top of Symfony, it is very easy to write functional tests for your application.
Functional tests are automated software tests that ensure that your code is working correctly. They go
through the user interface, using a fake browser, and mimic the actions a user would do.

Why
If you are not familiar with software tests, you may be wondering why you would need this. Every time
you make a change to your application, you have to test it. This means going through all the pages and
making sure they are still working. Functional tests save you a lot of time, because they enable you to test
your application in usually under a second by running a single command.
For more information on functional testing, unit testing, and automated software tests in general, check
out PHPUnit1 and Bulat Shakirzyanov's talk on Clean Code.

PHPUnit
PHPUnit2 is the de-facto standard testing framework for PHP. It was built for writing unit tests, but
it can be used for functional tests too. You write tests by creating a new class, that extends the
PHPUnit\Framework\TestCase. Your test cases are methods prefixed with test:
Listing 7-1 1 use PHPUnit\Framework\TestCase;
2
3 class ContactFormTest extends TestCase
4 {
5 public function testInitialPage()
6 {
7 ...
8 }
9 }

1. https://github.com/sebastianbergmann/phpunit
2. https://github.com/sebastianbergmann/phpunit

PDF brought to you by Chapter 7: Testing | 35

generated on April 10, 2019

 In your test cases, you do assertions on the state of what you are testing. In this case we are testing a
contact form, so we would want to assert that the page loaded correctly and contains our form:

Listing 7-2 1 public function testInitialPage()

2 {
3 $statusCode = ...
4 $pageContent = ...
5
6 $this->assertEquals(200, $statusCode);
7 $this->assertContains('Contact us', $pageContent);
8 $this->assertContains('<form', $pageContent);
9 }

Here you see some of the available assertions. There is a full list available in the Writing Tests for
PHPUnit3 section of the PHPUnit documentation.

WebTestCase
Symfony provides a WebTestCase class that can be used to write functional tests. The Silex version of
this class is Silex\WebTestCase, and you can use it by making your test extend it:

Listing 7-3 1 use Silex\WebTestCase;

2
3 class ContactFormTest extends WebTestCase
4 {
5 ...
6 }

If you need to override the setUp() method, don't forget to call the parent (parent::setUp())
to call the Silex default setup.

If you want to use the Symfony WebTestCase class you will need to explicitly install its
dependencies for your project:

Listing 7-4 1 composer require --dev symfony/browser-kit symfony/css-selector

For your WebTestCase, you will have to implement a createApplication method, which returns
your application instance:

Listing 7-5 1 public function createApplication()

2 {
3 // app.php must return an Application instance
4 return require __DIR__.'/path/to/app.php';
5 }

Make sure you do not use require_once here, as this method will be executed before every test.

3. https://phpunit.de/manual/current/en/writing-tests-for-phpunit.html

PDF brought to you by Chapter 7: Testing | 36

generated on April 10, 2019

 By default, the application behaves in the same way as when using it from a browser. But when an
error occurs, it is sometimes easier to get raw exceptions instead of HTML pages. It is rather simple
if you tweak the application configuration in the createApplication() method like follows:

Listing 7-6 1 public function createApplication()

2 {
3 $app = require __DIR__.'/path/to/app.php';
4 $app['debug'] = true;
5 unset($app['exception_handler']);
6
7 return $app;
8 }

If your application use sessions, set session.test to true to simulate sessions:

Listing 7-7 1 public function createApplication()

2 {
3 // ...
4
5 $app['session.test'] = true;
6
7 // ...
8 }

The WebTestCase provides a createClient method. A client acts as a browser, and allows you to
interact with your application. Here's how it works:

Listing 7-8 1 public function testInitialPage()

2 {
3 $client = $this->createClient();
4 $crawler = $client->request('GET', '/');
5
6 $this->assertTrue($client->getResponse()->isOk());
7 $this->assertCount(1, $crawler->filter('h1:contains("Contact us")'));
8 $this->assertCount(1, $crawler->filter('form'));
9 ...
10 }

There are several things going on here. You have both a Client and a Crawler.
You can also access the application through $this->app.

Client
The client represents a browser. It holds your browsing history, cookies and more. The request method
allows you to make a request to a page on your application.

You can find some documentation for it in the client section of the testing chapter of the Symfony
documentation.

Crawler
The crawler allows you to inspect the content of a page. You can filter it using CSS expressions and lots
more.

PDF brought to you by Chapter 7: Testing | 37

generated on April 10, 2019

 You can find some documentation for it in the crawler section of the testing chapter of the Symfony
documentation.

Configuration
The suggested way to configure PHPUnit is to create a phpunit.xml.dist file, a tests folder and
your tests in tests/YourApp/Tests/YourTest.php. The phpunit.xml.dist file should look
like this:

Listing 7-9 1 <?xml version="1.0" encoding="UTF-8"?>

2 <phpunit bootstrap="./vendor/autoload.php"
3 backupGlobals="false"
4 backupStaticAttributes="false"
5 colors="true"
6 convertErrorsToExceptions="true"
7 convertNoticesToExceptions="true"
8 convertWarningsToExceptions="true"
9 processIsolation="false"
10 stopOnFailure="false"
11 syntaxCheck="false"
12 >
13 <testsuites>
14 <testsuite name="YourApp Test Suite">
15 <directory>./tests/</directory>
16 </testsuite>
17 </testsuites>
18 </phpunit>

Your tests/YourApp/Tests/YourTest.php should look like this:

Listing 7-10 1 namespace YourApp\Tests;

2
3 use Silex\WebTestCase;
4
5 class YourTest extends WebTestCase
6 {
7 public function createApplication()
8 {
9 return require __DIR__.'/../../../app.php';
10 }
11
12 public function testFooBar()
13 {
14 ...
15 }
16 }

Now, when running phpunit on the command line, tests should run.

PDF brought to you by Chapter 7: Testing | 38

generated on April 10, 2019

 Chapter 8
Accepting a JSON Request Body

A common need when building a restful API is the ability to accept a JSON encoded entity from the
request body.
An example for such an API could be a blog post creation.

Example API
In this example we will create an API for creating a blog post. The following is a spec of how we want it
to work.

Request
In the request we send the data for the blog post as a JSON object. We also indicate that using the
Content-Type header:
Listing 8-1 1 POST /blog/posts
2 Accept: application/json
3 Content-Type: application/json
4 Content-Length: 57
5
6 {"title":"Hello World!","body":"This is my first post!"}

Response
The server responds with a 201 status code, telling us that the post was created. It tells us the Content-
Type of the response, which is also JSON:
Listing 8-2 1 HTTP/1.1 201 Created
2 Content-Type: application/json
3 Content-Length: 65
4 Connection: close
5
6 {"id":"1","title":"Hello World!","body":"This is my first post!"}

PDF brought to you by Chapter 8: Accepting a JSON Request Body | 39

generated on April 10, 2019

 Parsing the request body
The request body should only be parsed as JSON if the Content-Type header begins with
application/json. Since we want to do this for every request, the easiest solution is to use an
application before middleware.
We simply use json_decode to parse the content of the request and then replace the request data on
the $request object:

Listing 8-3 1 use Symfony\Component\HttpFoundation\Request;

2 use Symfony\Component\HttpFoundation\ParameterBag;
3
4 $app->before(function (Request $request) {
5 if (0 === strpos($request->headers->get('Content-Type'), 'application/json')) {
6 $data = json_decode($request->getContent(), true);
7 $request->request->replace(is_array($data) ? $data : array());
8 }
9 });

Controller implementation
Our controller will create a new blog post from the data provided and will return the post object,
including its id, as JSON:

Listing 8-4 1 use Symfony\Component\HttpFoundation\Request;

2 use Symfony\Component\HttpFoundation\Response;
3
4 $app->post('/blog/posts', function (Request $request) use ($app) {
5 $post = array(
6 'title' => $request->request->get('title'),
7 'body' => $request->request->get('body'),
8 );
9
10 $post['id'] = createPost($post);
11
12 return $app->json($post, 201);
13 });

Manual testing
In order to manually test our API, we can use the curl command line utility, which allows sending
HTTP requests:

Listing 8-5 1 $ curl http://blog.lo/blog/posts -d '{"title":"Hello World!","body":"This is my first post!"}' -H

2 'Content-Type: application/json'
{"id":"1","title":"Hello World!","body":"This is my first post!"}

PDF brought to you by Chapter 8: Accepting a JSON Request Body | 40

generated on April 10, 2019

 Chapter 9
Using PdoSessionStorage to store Sessions in
the Database

By default, the SessionServiceProvider writes session information in files using Symfony

NativeFileSessionStorage. Most medium to large websites use a database to store sessions instead of files,
because databases are easier to use and scale in a multi-webserver environment.
Symfony's NativeSessionStorage1 has multiple storage handlers and one of them uses PDO to store
sessions, PdoSessionHandler2. To use it, replace the session.storage.handler service in your
application like explained below.

With a dedicated PDO service

Listing 9-1 1 use Symfony\Component\HttpFoundation\Session\Storage\Handler\PdoSessionHandler;
2
3 $app->register(new Silex\Provider\SessionServiceProvider());
4
5 $app['pdo.dsn'] = 'mysql:dbname=mydatabase';
6 $app['pdo.user'] = 'myuser';
7 $app['pdo.password'] = 'mypassword';
8
9 $app['session.db_options'] = array(
10 'db_table' => 'session',
11 'db_id_col' => 'session_id',
12 'db_data_col' => 'session_value',
13 'db_time_col' => 'session_time',
14 );
15
16 $app['pdo'] = function () use ($app) {
17 return new PDO(
18 $app['pdo.dsn'],
19 $app['pdo.user'],
20 $app['pdo.password']
21 );

1. https://api.symfony.com/master/Symfony/Component/HttpFoundation/Session/Storage/NativeSessionStorage.html
2. https://api.symfony.com/master/Symfony/Component/HttpFoundation/Session/Storage/Handler/PdoSessionHandler.html

PDF brought to you by Chapter 9: Using PdoSessionStorage to store Sessions in the Database | 41

generated on April 10, 2019

 22 };
23
24 $app['session.storage.handler'] = function () use ($app) {
25 return new PdoSessionHandler(
26 $app['pdo'],
27 $app['session.db_options']
28 );
29 };

Using the DoctrineServiceProvider

When using the DoctrineServiceProvider You don't have to make another database connection, simply
pass the getWrappedConnection method.

Listing 9-2 1 use Symfony\Component\HttpFoundation\Session\Storage\Handler\PdoSessionHandler;

2
3 $app->register(new Silex\Provider\SessionServiceProvider());
4
5 $app['session.storage.handler'] = function () use ($app) {
6 return new PdoSessionHandler(
7 $app['db']->getWrappedConnection(),
8 array(
9 'db_table' => 'session',
10 'db_id_col' => 'session_id',
11 'db_data_col' => 'session_value',
12 'db_lifetime_col' => 'session_lifetime',
13 'db_time_col' => 'session_time',
14 )
15 );
16 };

Database structure
PdoSessionStorage needs a database table with 3 columns:

• session_id:ID column (VARCHAR(255) or larger)

• session_value: Value column (TEXT or CLOB)
• session_lifetime: Lifetime column (INTEGER)
• session_time: Time column (INTEGER)

You can find examples of SQL statements to create the session table in the Symfony cookbook3

3. https://symfony.com/doc/current/cookbook/configuration/pdo_session_storage.html#example-sql-statements

PDF brought to you by Chapter 9: Using PdoSessionStorage to store Sessions in the Database | 42

generated on April 10, 2019

 Chapter 10
Disabling CSRF Protection on a Form using the
FormExtension

The FormExtension provides a service for building form in your application with the Symfony Form
component. When the CSRF Service Provider is registered, the FormExtension uses the CSRF Protection
avoiding Cross-site request forgery, a method by which a malicious user attempts to make your legitimate
users unknowingly submit data that they don't intend to submit.
You can find more details about CSRF Protection and CSRF token in the Symfony Book1.
In some cases (for example, when embedding a form in an html email) you might want not to use this
protection. The easiest way to avoid this is to understand that it is possible to give specific options to
your form builder through the createBuilder() function.

Example
Listing 10-1 1 $form = $app['form.factory']->createBuilder('form', null, array('csrf_protection' => false));

That's it, your form could be submitted from everywhere without CSRF Protection.

Going further
This specific example showed how to change the csrf_protection in the $options parameter of
the createBuilder() function. More of them could be passed through this parameter, it is as simple
as using the Symfony getDefaultOptions() method in your form classes. See more here2.

1. https://symfony.com/doc/current/book/forms.html#csrf-protection
2. https://symfony.com/doc/current/book/forms.html#book-form-creating-form-classes

PDF brought to you by Chapter 10: Disabling CSRF Protection on a Form using the FormExtension | 43

generated on April 10, 2019

 Chapter 11
Using YAML to configure Validation

Simplicity is at the heart of Silex so there is no out of the box solution to use YAML files for validation.
But this doesn't mean that this is not possible. Let's see how to do it.
First, you need to install the YAML Component:

Listing 11-1 1 composer require symfony/yaml

Next, you need to tell the Validation Service that you are not using StaticMethodLoader to load your
class metadata but a YAML file:

Listing 11-2 1 $app->register(new ValidatorServiceProvider());

2
3 $app['validator.mapping.class_metadata_factory'] = new
4 Symfony\Component\Validator\Mapping\Factory\LazyLoadingMetadataFactory(
5 new Symfony\Component\Validator\Mapping\Loader\YamlFileLoader(__DIR__.'/validation.yml')
);

Now, we can replace the usage of the static method and move all the validation rules to
validation.yml:
Listing 11-3 1 # validation.yml
2 Post:
3 properties:
4 title:
5 - NotNull: ~
6 - NotBlank: ~
7 body:
8 - Min: 100

PDF brought to you by Chapter 11: Using YAML to configure Validation | 44

generated on April 10, 2019

 Chapter 12
Making sub-Requests

Since Silex is based on the HttpKernelInterface, it allows you to simulate requests against your
application. This means that you can embed a page within another, it also allows you to forward a request
which is essentially an internal redirect that does not change the URL.

Basics
You can make a sub-request by calling the handle method on the Application. This method takes
three arguments:

• $request:
An instance of the Request class which represents the
HTTP request.

• $type:
Must be either HttpKernelInterface::MASTER_REQUEST or HttpKernelInterface::SUB_REQUEST. Certain
listeners are only executed for the master request, so it's important that this is set to SUB_REQUEST.
• $catch: Catches exceptions and turns them into a response with status code 500. This argument
defaults to true. For sub-requests you will most likely want to set it to false.

By calling handle, you can make a sub-request manually. Here's an example:

Listing 12-1 1 use Symfony\Component\HttpFoundation\Request;

2 use Symfony\Component\HttpKernel\HttpKernelInterface;
3
4 $subRequest = Request::create('/');
5 $response = $app->handle($subRequest, HttpKernelInterface::SUB_REQUEST, false);

There's some more things that you need to keep in mind though. In most cases you will want to forward
some parts of the current master request to the sub-request like cookies, server information, or the
session.
Here is a more advanced example that forwards said information ($request holds the master request):

Listing 12-2 1 use Symfony\Component\HttpFoundation\Request;

2 use Symfony\Component\HttpKernel\HttpKernelInterface;
3
4 $subRequest = Request::create('/', 'GET', array(), $request->cookies->all(), array(), $request->server->all());

PDF brought to you by Chapter 12: Making sub-Requests | 45

generated on April 10, 2019

 5 if ($request->getSession()) {
6 $subRequest->setSession($request->getSession());
7 }
8
9 $response = $app->handle($subRequest, HttpKernelInterface::SUB_REQUEST, false);

To forward this response to the client, you can simply return it from a controller:

Listing 12-3 1 use Silex\Application;

2 use Symfony\Component\HttpFoundation\Request;
3 use Symfony\Component\HttpKernel\HttpKernelInterface;
4
5 $app->get('/foo', function (Application $app, Request $request) {
6 $subRequest = Request::create('/', ...);
7 $response = $app->handle($subRequest, HttpKernelInterface::SUB_REQUEST, false);
8
9 return $response;
10 });

If you want to embed the response as part of a larger page you can call Response::getContent:

Listing 12-4 1 $header = ...;

2 $footer = ...;
3 $body = $response->getContent();
4
5 return $header.$body.$footer;

Rendering pages in Twig templates

The TwigServiceProvider provides a render function that you can use in Twig templates. It gives you a
convenient way to embed pages.

Listing 12-5 1 {{ render('/sidebar') }}

For details, refer to the TwigServiceProvider docs.

Edge Side Includes

You can use ESI either through the HttpCacheServiceProvider or a reverse proxy cache such as Varnish.
This also allows you to embed pages, however it also gives you the benefit of caching parts of the page.
Here is an example of how you would embed a page via ESI:

Listing 12-6 1 <esi:include src="/sidebar" />

For details, refer to the HttpCacheServiceProvider docs.

Dealing with the request base URL

One thing to watch out for is the base URL. If your application is not hosted at the webroot of your web
server, then you may have an URL like http://example.org/foo/index.php/articles/42.
In this case, /foo/index.php is your request base path. Silex accounts for this path prefix in the
routing process, it reads it from $request->server. In the context of sub-requests this can lead to

PDF brought to you by Chapter 12: Making sub-Requests | 46

generated on April 10, 2019

 issues, because if you do not prepend the base path the request could mistake a part of the path you want
to match as the base path and cut it off.
You can prevent that from happening by always prepending the base path when constructing a request:

Listing 12-7
$url = $request->getUriForPath('/');
$subRequest = Request::create($url, 'GET', array(), $request->cookies->all(), array(), $request->server->all());

This is something to be aware of when making sub-requests by hand.

Services depending on the Request

The container is a concept that is global to a Silex application, since the application object is the
container. Any request that is run against an application will re-use the same set of services. Since these
services are mutable, code in a master request can affect the sub-requests and vice versa. Any services
depending on the request service will store the first request that they get (could be master or sub-
request), and keep using it, even if that request is already over.
Instead of injecting the request service, you should always inject the request_stack one instead.

PDF brought to you by Chapter 12: Making sub-Requests | 47

generated on April 10, 2019

 Chapter 13
Converting Errors to Exceptions

Silex catches exceptions that are thrown from within a request/response cycle. However, it does not catch
PHP errors and notices. This recipe tells you how to catch them by converting them to exceptions.

Registering the ErrorHandler

The Symfony/Debug package has an ErrorHandler class that solves this problem. It converts all
errors to exceptions, and exceptions are then caught by Silex.
Register it by calling the static register method:

Listing 13-1
use Symfony\Component\Debug\ErrorHandler;

ErrorHandler::register();

It is recommended that you do this as early as possible.

Handling fatal errors

To handle fatal errors, you can additionally register a global ExceptionHandler:

Listing 13-2
use Symfony\Component\Debug\ExceptionHandler;

ExceptionHandler::register();

In production you may want to disable the debug output by passing false as the $debug argument:

Listing 13-3
use Symfony\Component\Debug\ExceptionHandler;

ExceptionHandler::register(false);

PDF brought to you by Chapter 13: Converting Errors to Exceptions | 48

generated on April 10, 2019

 Important caveat when using Silex on a command-line interface: The ExceptionHandler should
not be enabled as it would convert an error to HTML output and return a non-zero exit code:

Listing 13-4 1 use Symfony\Component\Debug\ExceptionHandler;

2
3 if (!in_array(PHP_SAPI, ['cli', 'phpdbg'])) {
4 ExceptionHandler::register();
5 }

PDF brought to you by Chapter 13: Converting Errors to Exceptions | 49

generated on April 10, 2019

 Chapter 14
Using multiple Monolog Loggers

Having separate instances of Monolog for different parts of your system is often desirable and allows you
to configure them independently, allowing for fine grained control of where your logging goes and in
what detail.
This simple example allows you to quickly configure several monolog instances, using the bundled
handler, but each with a different channel.

Listing 14-1 1 $app['monolog.factory'] = $app->protect(function ($name) use ($app) {

2 $log = new $app['monolog.logger.class']($name);
3 $log->pushHandler($app['monolog.handler']);
4
5 return $log;
6 });
7
8 foreach (array('auth', 'payments', 'stats') as $channel) {
9 $app['monolog.'.$channel] = function ($app) use ($channel) {
10 return $app['monolog.factory']($channel);
11 };
12 }

As your application grows, or your logging needs for certain areas of the system become apparent,
it should be straightforward to then configure that particular service separately, including your
customizations.

Listing 14-2 1 use Monolog\Handler\StreamHandler;

2
3 $app['monolog.payments'] = function ($app) {
4 $log = new $app['monolog.logger.class']('payments');
5 $handler = new StreamHandler($app['monolog.payments.logfile'], $app['monolog.payment.level']);
6 $log->pushHandler($handler);
7
8 return $log;
9 };

Alternatively, you could attempt to make the factory more complicated, and rely on some conventions,
such as checking for an array of handlers registered with the container with the channel name, defaulting
to the bundled handler.

Listing 14-3

PDF brought to you by Chapter 14: Using multiple Monolog Loggers | 50

generated on April 10, 2019

 1 use Monolog\Handler\StreamHandler;
2 use Monolog\Logger;
3
4 $app['monolog.factory'] = $app->protect(function ($name) use ($app) {
5 $log = new $app['monolog.logger.class']($name);
6
7 $handlers = isset($app['monolog.'.$name.'.handlers'])
8 ? $app['monolog.'.$name.'.handlers']
9 : array($app['monolog.handler']);
10
11 foreach ($handlers as $handler) {
12 $log->pushHandler($handler);
13 }
14
15 return $log;
16 });
17
18 $app['monolog.payments.handlers'] = function ($app) {
19 return array(
20 new StreamHandler(__DIR__.'/../payments.log', Logger::DEBUG),
21 );
22 };

PDF brought to you by Chapter 14: Using multiple Monolog Loggers | 51

generated on April 10, 2019

 Chapter 15
How to Create a Custom Authentication
System with Guard

Whether you need to build a traditional login form, an API token authentication system or you need to
integrate with some proprietary single-sign-on system, the Guard component can make it easy... and fun!
In this example, you'll build an API token authentication system and learn how to work with Guard.

Step 1) Create the Authenticator Class

Suppose you have an API where your clients will send an X-AUTH-TOKEN header on each request. This
token is composed of the username followed by a password, separated by a colon (e.g. X-AUTH-TOKEN:
coolguy:awesomepassword). Your job is to read this, find the associated user (if any) and check the
password.
To create a custom authentication system, just create a class and make it implement
GuardAuthenticatorInterface. Or, extend the simpler AbstractGuardAuthenticator. This requires you to
implement six methods:

Listing 15-1 1 <?php

2
3 namespace App\Security;
4
5 use Symfony\Component\HttpFoundation\Request;
6 use Symfony\Component\HttpFoundation\JsonResponse;
7 use Symfony\Component\Security\Core\User\UserInterface;
8 use Symfony\Component\Security\Core\User\UserProviderInterface;
9 use Symfony\Component\Security\Guard\AbstractGuardAuthenticator;
10 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
11 use Symfony\Component\Security\Core\Exception\AuthenticationException;
12 use Symfony\Component\Security\Core\Encoder\EncoderFactoryInterface;
13
14 class TokenAuthenticator extends AbstractGuardAuthenticator
15 {
16 private $encoderFactory;
17
18 public function __construct(EncoderFactoryInterface $encoderFactory)

PDF brought to you by Chapter 15: How to Create a Custom Authentication System with Guard | 52

generated on April 10, 2019

19 {
20 $this->encoderFactory = $encoderFactory;
21 }
22
23 public function getCredentials(Request $request)
24 {
25 // Checks if the credential header is provided
26 if (!$token = $request->headers->get('X-AUTH-TOKEN')) {
27 return;
28 }
29
30 // Parse the header or ignore it if the format is incorrect.
31 if (false === strpos($token, ':')) {
32 return;
33 }
34 list($username, $secret) = explode(':', $token, 2);
35
36 return array(
37 'username' => $username,
38 'secret' => $secret,
39 );
40 }
41
42 public function getUser($credentials, UserProviderInterface $userProvider)
43 {
44 return $userProvider->loadUserByUsername($credentials['username']);
45 }
46
47 public function checkCredentials($credentials, UserInterface $user)
48 {
49 // check credentials - e.g. make sure the password is valid
50 // return true to cause authentication success
51
52 $encoder = $this->encoderFactory->getEncoder($user);
53
54 return $encoder->isPasswordValid(
55 $user->getPassword(),
56 $credentials['secret'],
57 $user->getSalt()
58 );
59 }
60
61 public function onAuthenticationSuccess(Request $request, TokenInterface $token, $providerKey)
62 {
63 // on success, let the request continue
64 return;
65 }
66
67 public function onAuthenticationFailure(Request $request, AuthenticationException $exception)
68 {
69 $data = array(
70 'message' => strtr($exception->getMessageKey(), $exception->getMessageData()),
71
72 // or to translate this message
73 // $this->translator->trans($exception->getMessageKey(), $exception->getMessageData())
74 );
75
76 return new JsonResponse($data, 403);
77 }
78
79 /**
80 * Called when authentication is needed, but it's not sent
81 */
82 public function start(Request $request, AuthenticationException $authException = null)
83 {
84 $data = array(
85 // you might translate this message
86 'message' => 'Authentication Required',
87 );
88
89 return new JsonResponse($data, 401);

PDF brought to you by Chapter 15: How to Create a Custom Authentication System with Guard | 53

generated on April 10, 2019

 90 }
91
92 public function supportsRememberMe()
93 {
94 return false;
95 }
96 }

Step 2) Configure the Authenticator

To finish this, register the class as a service:

Listing 15-2 1 $app['app.token_authenticator'] = function ($app) {

2 return new App\Security\TokenAuthenticator($app['security.encoder_factory']);
3 };

Finally, configure your security.firewalls key to use this authenticator:

Listing 15-3 1 $app['security.firewalls'] = array(

2 'main' => array(
3 'guard' => array(
4 'authenticators' => array(
5 'app.token_authenticator'
6 ),
7
8 // Using more than 1 authenticator, you must specify
9 // which one is used as entry point.
10 // 'entry_point' => 'app.token_authenticator',
11 ),
12 // configure where your users come from. Hardcode them, or load them from somewhere
13 // https://silex.symfony.com/doc/providers/security.html#defining-a-custom-user-provider
14 'users' => array(
15 //raw password = foo
16 'victoria' => array('ROLE_USER', '$2y$10$3i9/lVd8UOFIJ6PAMFt8gu3/r5g0qeCJvoSlLCsvMTythye19F77a'),
17 ),
18 // 'anonymous' => true
19 ),
20 );

You can use many authenticators, they are executed by the order they are configured.

You did it! You now have a fully-working API token authentication system. If your homepage required
ROLE_USER, then you could test it under different conditions:

Listing 15-4 1 # test with no token

2 curl http://localhost:8000/
3 # {"message":"Authentication Required"}
4
5 # test with a bad token
6 curl -H "X-AUTH-TOKEN: alan" http://localhost:8000/
7 # {"message":"Username could not be found."}
8
9 # test with a working token
10 curl -H "X-AUTH-TOKEN: victoria:foo" http://localhost:8000/
11 # the homepage controller is executed: the page loads normally

For more details read the Symfony cookbook entry on How to Create a Custom Authentication System
with Guard1.

1. https://symfony.com/doc/current/cookbook/security/guard-authentication.html

PDF brought to you by Chapter 15: How to Create a Custom Authentication System with Guard | 54

generated on April 10, 2019

 Chapter 16
Internals

This chapter will tell you how Silex works internally.

Silex
Application
The application is the main interface to Silex. It implements Symfony's HttpKernelInterface1, so you can
pass a Request2 to the handle method and it will return a Response3.
It extends the Pimple service container, allowing for flexibility on the outside as well as the inside. You
could replace any service, and you are also able to read them.
The application makes strong use of the EventDispatcher4 to hook into the Symfony HttpKernel5 events.
This allows fetching the Request, converting string responses into Response objects and handling
Exceptions. We also use it to dispatch some custom events like before/after middlewares and errors.

Controller
The Symfony Route6 is actually quite powerful. Routes can be named, which allows for URL generation.
They can also have requirements for the variable parts. In order to allow setting these through a nice
interface, the match method (which is used by get, post, etc.) returns an instance of the Controller,
which wraps a route.

1. https://api.symfony.com/master/Symfony/Component/HttpKernel/HttpKernelInterface.html
2. https://api.symfony.com/master/Symfony/Component/HttpFoundation/Request.html
3. https://api.symfony.com/master/Symfony/Component/HttpFoundation/Response.html
4. https://api.symfony.com/master/Symfony/Component/EventDispatcher/EventDispatcher.html
5. https://api.symfony.com/master/Symfony/Component/HttpKernel/HttpKernel.html
6. https://api.symfony.com/master/Symfony/Component/Routing/Route.html

PDF brought to you by Chapter 16: Internals | 55

generated on April 10, 2019

ControllerCollection
One of the goals of exposing the RouteCollection7 was to make it mutable, so providers could add stuff to
it. The challenge here is the fact that routes know nothing about their name. The name only has meaning
in context of the RouteCollection and cannot be changed.
To solve this challenge we came up with a staging area for routes. The ControllerCollection holds
the controllers until flush is called, at which point the routes are added to the RouteCollection.
Also, the controllers are then frozen. This means that they can no longer be modified and will throw an
Exception if you try to do so.
Unfortunately no good way for flushing implicitly could be found, which is why flushing is now always
explicit. The Application will flush, but if you want to read the ControllerCollection before the
request takes place, you will have to call flush yourself.
The Application provides a shortcut flush method for flushing the ControllerCollection.

Instead of creating an instance of RouteCollection yourself, use the

$app['controllers_factory'] factory instead.

Symfony
Following Symfony components are used by Silex:

• HttpFoundation: For Request and Response.

• HttpKernel: Because we need a heart.
• Routing: For matching defined routes.
• EventDispatcher: For hooking into the HttpKernel.

For more information, check out the Symfony website8.

7. https://api.symfony.com/master/Symfony/Component/Routing/RouteCollection.html
8. https://symfony.com/

PDF brought to you by Chapter 16: Internals | 56

generated on April 10, 2019

 Chapter 17
Contributing

We are open to contributions to the Silex code. If you find a bug or want to contribute a provider, just
follow these steps:

• Fork the Silex repository1;

• Make your feature addition or bug fix;
• Add tests for it;
• Optionally, add some documentation;
• Send a pull request2, to the correct target branch (1.3 for bug fixes, master for new features).

Any code you contribute must be licensed under the MIT License.

1. https://github.com/silexphp/Silex
2. https://help.github.com/articles/creating-a-pull-request

PDF brought to you by Chapter 17: Contributing | 57

generated on April 10, 2019

 Chapter 18
Writing Documentation

The documentation is written in reStructuredText3 and can be generated using sphinx4.

Listing 18-1 1 $ cd doc

2 $ sphinx-build -b html . build

3. http://docutils.sourceforge.net/rst.html
4. http://sphinx-doc.org

PDF brought to you by Chapter 18: Writing Documentation | 58

generated on April 10, 2019

 Chapter 19
Twig

The TwigServiceProvider provides integration with the Twig1 template engine.

Parameters
• twig.path (optional): Path to the directory containing twig template files (it can also be an array of
paths).
• twig.templates (optional): An associative array of template names to template contents. Use this if
you want to define your templates inline.
• twig.options (optional): An associative array of twig options. Check out the twig documentation2
for more information.
• twig.form.templates (optional): An array of templates used to render forms (only available when
the FormServiceProvider is enabled). The default theme is form_div_layout.html.twig, but you can use
the other built-in themes: form_table_layout.html.twig, bootstrap_3_layout.html.twig, and
bootstrap_3_horizontal_layout.html.twig.
• twig.date.format (optional): Default format used by the date filter. The format string must conform
to the format accepted by date()3.
• twig.date.interval_format (optional): Default format used by the date filter when the filtered
data is of type DateInterval4. The format string must conform to the format accepted by
DateInterval::format()5.
• twig.date.timezone (optional): Default timezone used when formatting dates. If set to null the
timezone returned by date_default_timezone_get()6 is used.
• twig.number_format.decimals (optional): Default number of decimals displayed by the
number_format filter.
• twig.number_format.decimal_point (optional): Default separator for the decimal point used by
the number_format filter.

1. https://twig.symfony.com/
2. https://twig.symfony.com/doc/api.html#environment-options
3. https://secure.php.net/date
4. https://secure.php.net/DateInterval
5. https://secure.php.net/DateInterval.format
6. https://secure.php.net/date_default_timezone_get

PDF brought to you by Chapter 19: Twig | 59

generated on April 10, 2019

 • twig.number_format.thousands_separator (optional): Default thousands separator used by the
number_format filter.

Services
• twig: The Twig_Environment instance. The main way of interacting with Twig.
• twig.loader: The loader for Twig templates which uses the twig.path and the twig.templates options.
You can also replace the loader completely.

Registering
Listing 19-1 1 $app->register(new Silex\Provider\TwigServiceProvider(), array(
2 'twig.path' => __DIR__.'/views',
3 ));

Add Twig as a dependency:

Listing 19-2 1 composer require twig/twig

Usage
The Twig provider provides a twig service that can render templates:

Listing 19-3 1 $app->get('/hello/{name}', function ($name) use ($app) {

2 return $app['twig']->render('hello.twig', array(
3 'name' => $name,
4 ));
5 });

Symfony Components Integration

Symfony provides a Twig bridge that provides additional integration between some Symfony components
and Twig. Add it as a dependency:

Listing 19-4 1 composer require symfony/twig-bridge

When present, the TwigServiceProvider will provide you with the following additional capabilities.

• Access to the path() and url() functions. You can find more information in the Symfony Routing
documentation7:

Listing 19-5 1 {{ path('homepage') }}

2 {{ url('homepage') }} {# generates the absolute url http://example.org/ #}
3 {{ path('hello', {name: 'Fabien'}) }}
4 {{ url('hello', {name: 'Fabien'}) }} {# generates the absolute url http://example.org/hello/Fabien #}

• Access to the absolute_url() and relative_path() Twig functions.

7. https://symfony.com/doc/current/book/routing.html#generating-urls-from-a-template

PDF brought to you by Chapter 19: Twig | 60

generated on April 10, 2019

 Translations Support
If you are using the TranslationServiceProvider, you will get the trans() and
transchoice() functions for translation in Twig templates. You can find more information in the
Symfony Translation documentation8.

Form Support
If you are using the FormServiceProvider, you will get a set of helpers for working with forms in
templates. You can find more information in the Symfony Forms reference.

Security Support
If you are using the SecurityServiceProvider, you will have access to the is_granted()
function in templates. You can find more information in the Symfony Security documentation9.

Web Link Support

If you are using the symfony/web-link component, you will have access to the preload(),
prefetch(), prerender(), dns_prefetch(), preconnect() and link() functions in
templates. You can find more information in the Symfony WebLink documentation10.

Global Variable
When the Twig bridge is available, the global variable refers to an instance of AppVariable11. It gives
access to the following methods:

Listing 19-6 1 {# The current Request #}

2 {{ global.request }}
3
4 {# The current User (when security is enabled) #}
5 {{ global.user }}
6
7 {# The current Session #}
8 {{ global.session }}
9
10 {# The debug flag #}
11 {{ global.debug }}
12
13 {# The flash messages (Symfony 3.3 or later) #}
14 {{ global.flashes }}

Rendering a Controller
A render function is also registered to help you render another controller from a template (available
when the HttpFragment Service Provider is registered):

Listing 19-7 1 {{ render(url('sidebar')) }}

2
3 {# or you can reference a controller directly without defining a route for it #}
4 {{ render(controller(controller)) }}

8. https://symfony.com/doc/current/book/translation.html#twig-templates
9. https://symfony.com/doc/current/book/security.html#access-control-in-templates
10. https://symfony.com/doc/current/components/weblink/introduction.html
11. https://api.symfony.com/master/Symfony/Bridge/Twig/AppVariable.html

PDF brought to you by Chapter 19: Twig | 61

generated on April 10, 2019

 You must prepend the app.request.baseUrl to render calls to ensure that the render works
when deployed into a sub-directory of the docroot.

Read the Twig reference12 for Symfony document to learn more about the various Twig functions.

Traits
Silex\Application\TwigTrait adds the following shortcuts:
• render: Renders a view with the given parameters and returns a Response object.

Listing 19-8 1 return $app->render('index.html', ['name' => 'Fabien']);

2
3 $response = new Response();
4 $response->setTtl(10);
5
6 return $app->render('index.html', ['name' => 'Fabien'], $response);

Listing 19-9 1 // stream a view

2 use Symfony\Component\HttpFoundation\StreamedResponse;
3
4 return $app->render('index.html', ['name' => 'Fabien'], new StreamedResponse());

• renderView: Renders a view with the given parameters and returns a string.

Listing 19-10 1 $content = $app->renderView('index.html', ['name' => 'Fabien']);

Customization
You can configure the Twig environment before using it by extending the twig service:

Listing 19-11 1 $app->extend('twig', function($twig, $app) {

2 $twig->addGlobal('pi', 3.14);
3 $twig->addFilter('levenshtein', new \Twig_Filter_Function('levenshtein'));
4
5 return $twig;
6 });

For more information, check out the official Twig documentation13.

12. https://symfony.com/doc/current/reference/twig_reference.html#controller
13. https://twig.symfony.com

PDF brought to you by Chapter 19: Twig | 62

generated on April 10, 2019

 Chapter 20
Asset

The AssetServiceProvider provides a way to manage URL generation and versioning of web assets such as
CSS stylesheets, JavaScript files and image files.

Parameters
• assets.version: Default version for assets.
• assets.version_format (optional): Default format for assets.
• assets.base_path: Default path to prepend to all assets without a package.
• assets.base_urls: (Alternative to assets.base_path) List of base URLs to choose from to prepend to
assets without a package.
• assets.named_packages (optional): Named packages. Keys are the package names and values the
configuration (supported keys are version, version_format, base_urls, and base_path).
• assets.json_manifest_path (optional): Absolute path to a JSON version manifest1.

Services
• assets.packages: The asset service.

Registering
Listing 20-1 1 $app->register(new Silex\Provider\AssetServiceProvider(), array(
2 'assets.version' => 'v1',
3 'assets.version_format' => '%s?version=%s',
4 'assets.named_packages' => array(
5 'css' => array('version' => 'css2', 'base_path' => '/whatever-makes-sense'),
6 'images' => array('base_urls' => array('https://img.example.com')),
7 ),
8 ));

1. https://symfony.com/blog/new-in-symfony-3-3-manifest-based-asset-versioning

PDF brought to you by Chapter 20: Asset | 63

generated on April 10, 2019

 Add the Symfony Asset Component as a dependency:

Listing 20-2 1 composer require symfony/asset

If you want to use assets in your Twig templates, you must also install the Symfony Twig Bridge:

Listing 20-3 1 composer require symfony/twig-bridge

Usage
The AssetServiceProvider is mostly useful with the Twig provider using the asset() method. It takes
two arguments. In the case of named packages, the first is the path relative to the base_path specified in
the package definition and the second is the package name. For unmamed packages, there is only one
argument, the path relative to the assets folder:

Listing 20-4 1 {{ asset('/css/foo.png') }}

2 {{ asset('/css/foo.css', 'css') }}
3 {{ asset('/img/foo.png', 'images') }}
4
5 {{ asset_version('/css/foo.png') }}

For more information, check out the Asset Component documentation2.

2. https://symfony.com/doc/current/components/asset/introduction.html

PDF brought to you by Chapter 20: Asset | 64

generated on April 10, 2019

 Chapter 21
Monolog

The MonologServiceProvider provides a default logging mechanism through Jordi Boggiano's Monolog1
library.
It will log requests and errors and allow you to add logging to your application. This allows you to debug
and monitor the behaviour, even in production.

Parameters
• monolog.logfile: File where logs are written to.
• monolog.bubble (optional): Whether the messages that are handled can bubble up the stack or
not.
• monolog.permission (optional): File permissions default (null), nothing change.
• monolog.level (optional): Level of logging, defaults to DEBUG. Must be one of Logger::DEBUG,
Logger::INFO, Logger::WARNING, Logger::ERROR. DEBUG will log everything, INFO will
log everything except DEBUG, etc.
In addition to the Logger:: constants, it is also possible to supply the level in string form, for
example: "DEBUG", "INFO", "WARNING", "ERROR".
PSR-3 log levels from \Psr\Log\LogLevel:: constants are also supported.
• monolog.name (optional): Name of the monolog channel, defaults to myapp.
• monolog.exception.logger_filter (optional): An anonymous function that returns an error level
for on uncaught exception that should be logged.
• monolog.use_error_handler (optional): Whether errors and uncaught exceptions should be
handled by the Monolog ErrorHandler class and added to the log. By default the error handler is
enabled unless the application debug parameter is set to true.
Please note that enabling the error handler may silence some errors, ignoring the PHP
display_errors configuration setting.

1. https://github.com/Seldaek/monolog

PDF brought to you by Chapter 21: Monolog | 65

generated on April 10, 2019

 Services
• monolog: The monolog logger instance.
Example usage:

Listing 21-1
$app['monolog']->debug('Testing the Monolog logging.');

• monolog.listener: An event listener to log requests, responses and errors.

Registering
Listing 21-2 1 $app->register(new Silex\Provider\MonologServiceProvider(), array(
2 'monolog.logfile' => __DIR__.'/development.log',
3 ));

Add Monolog as a dependency:

Listing 21-3 1 composer require monolog/monolog

Usage
The MonologServiceProvider provides a monolog service. You can use it to add log entries for any
logging level through debug(), info(), warning() and error():

Listing 21-4 1 use Symfony\Component\HttpFoundation\Response;

2
3 $app->post('/user', function () use ($app) {
4 // ...
5
6 $app['monolog']->info(sprintf("User '%s' registered.", $username));
7
8 return new Response('', 201);
9 });

Customization
You can configure Monolog (like adding or changing the handlers) before using it by extending the
monolog service:
Listing 21-5 1 $app->extend('monolog', function($monolog, $app) {
2 $monolog->pushHandler(...);
3
4 return $monolog;
5 });

By default, all requests, responses and errors are logged by an event listener registered as a service called
monolog.listener. You can replace or remove this service if you want to modify or disable the logged
information.

PDF brought to you by Chapter 21: Monolog | 66

generated on April 10, 2019

 Traits
Silex\Application\MonologTrait adds the following shortcuts:
• log: Logs a message.

Listing 21-6 1 $app->log(sprintf("User '%s' registered.", $username));

For more information, check out the Monolog documentation2.

2. https://github.com/Seldaek/monolog

PDF brought to you by Chapter 21: Monolog | 67

generated on April 10, 2019

 Chapter 22
Session

The SessionServiceProvider provides a service for storing data persistently between requests.

Parameters
• session.storage.save_path (optional): The path for the NativeFileSessionHandler, defaults
to the value of sys_get_temp_dir().
• session.storage.options: An array of options that is passed to the constructor of the
session.storage service.
In case of the default NativeSessionStorage1, the most useful options are:

• name: The cookie name (_SESS by default)

• id: The session id (null by default)
• cookie_lifetime: Cookie lifetime
• cookie_path: Cookie path
• cookie_domain: Cookie domain
• cookie_secure: Cookie secure (HTTPS)
• cookie_httponly: Whether the cookie is http only

However, all of these are optional. Default Sessions life time is 1800 seconds (30 minutes). To
override this, set the lifetime option.
For a full list of available options, read the PHP2 official documentation.
• session.test: Whether to simulate sessions or not (useful when writing functional tests).
• session.attribute_bag (optional): The attribute bag service to use in the session. Instance of
AttributeBagInterface.
• session.flash_bag (optional): The flash bag service to use in the session. Instance of
FlashBagInterface.

1. https://api.symfony.com/master/Symfony/Component/HttpFoundation/Session/Storage/NativeSessionStorage.html
2. https://secure.php.net/session.configuration

PDF brought to you by Chapter 22: Session | 68

generated on April 10, 2019

 Services
• session: An instance of Symfony's Session3.
• session.storage: A service that is used for persistence of the session data.
• session.storage.handler: A service that is used by the session.storage for data access. Defaults to a
NativeFileSessionHandler4 storage handler.

Registering
Listing 22-1 1 $app->register(new Silex\Provider\SessionServiceProvider());

Using Handlers
The default session handler is NativeFileSessionHandler. However, there are multiple handlers
available for use by setting session.storage.handler to an instance of one of the following handler
objects:

• LegacyPdoSessionHandler5
• MemcacheSessionHandler6
• MemcachedSessionHandler7
• MongoDbSessionHandler8
• NativeFileSessionHandler9
• NativeSessionHandler10
• NullSessionHandler11
• PdoSessionHandler12
• WriteCheckSessionHandler13

Usage
The Session provider provides a session service. Here is an example that authenticates a user and
creates a session for them:

Listing 22-2 1 use Symfony\Component\HttpFoundation\Request;

2 use Symfony\Component\HttpFoundation\Response;
3
4 $app->get('/login', function (Request $request) use ($app) {
5 $username = $request->server->get('PHP_AUTH_USER', false);
6 $password = $request->server->get('PHP_AUTH_PW');
7
8 if ('igor' === $username && 'password' === $password) {

3. https://api.symfony.com/master/Symfony/Component/HttpFoundation/Session/Session.html
4. https://api.symfony.com/master/Symfony/Component/HttpFoundation/Session/Storage/Handler/NativeFileSessionHandler.html
5. https://api.symfony.com/master/Symfony/Component/HttpFoundation/Session/Storage/Handler/LegacyPdoSessionHandler.html
6. https://api.symfony.com/master/Symfony/Component/HttpFoundation/Session/Storage/Handler/MemcacheSessionHandler.html
7. https://api.symfony.com/master/Symfony/Component/HttpFoundation/Session/Storage/Handler/MemcachedSessionHandler.html
8. https://api.symfony.com/master/Symfony/Component/HttpFoundation/Session/Storage/Handler/MongoDbSessionHandler.html
9. https://api.symfony.com/master/Symfony/Component/HttpFoundation/Session/Storage/Handler/NativeFileSessionHandler.html
10. https://api.symfony.com/master/Symfony/Component/HttpFoundation/Session/Storage/Handler/NativeSessionHandler.html
11. https://api.symfony.com/master/Symfony/Component/HttpFoundation/Session/Storage/Handler/NullSessionHandler.html
12. https://api.symfony.com/master/Symfony/Component/HttpFoundation/Session/Storage/Handler/PdoSessionHandler.html
13. https://api.symfony.com/master/Symfony/Component/HttpFoundation/Session/Storage/Handler/WriteCheckSessionHandler.html

PDF brought to you by Chapter 22: Session | 69

generated on April 10, 2019

 9 $app['session']->set('user', array('username' => $username));
10 return $app->redirect('/account');
11 }
12
13 $response = new Response();
14 $response->headers->set('WWW-Authenticate', sprintf('Basic realm="%s"', 'site_login'));
15 $response->setStatusCode(401, 'Please sign in.');
16 return $response;
17 });
18
19 $app->get('/account', function () use ($app) {
20 if (null === $user = $app['session']->get('user')) {
21 return $app->redirect('/login');
22 }
23
24 return "Welcome {$user['username']}!";
25 });

Custom Session Configurations

If your system is using a custom session configuration (such as a redis handler from a PHP extension)
then you need to disable the NativeFileSessionHandler by setting session.storage.handler to null.
You will have to configure the session.save_path ini setting yourself in that case.

Listing 22-3 1 $app['session.storage.handler'] = null;

PDF brought to you by Chapter 22: Session | 70

generated on April 10, 2019

 Chapter 23
Swiftmailer

The SwiftmailerServiceProvider provides a service for sending email through the Swift Mailer1 library.
You can use the mailer service to send messages easily. By default, it will attempt to send emails
through SMTP.

Parameters
• swiftmailer.use_spool: A boolean to specify whether or not to use the memory spool, defaults to
true.
• swiftmailer.options: An array of options for the default SMTP-based configuration.
The following options can be set:

• host: SMTP hostname, defaults to 'localhost'.

• port: SMTP port, defaults to 25.
• username: SMTP username, defaults to an empty string.
• password: SMTP password, defaults to an empty string.
• encryption: SMTP encryption, defaults to null. Valid values are 'tls', 'ssl', or null (indicating
no encryption).
• auth_mode: SMTP authentication mode, defaults to null. Valid values are 'plain', 'login',
'cram-md5', or null.

Example usage:

Listing 23-1 1 $app['swiftmailer.options'] = array(

2 'host' => 'host',
3 'port' => '25',
4 'username' => 'username',
5 'password' => 'password',
6 'encryption' => null,
7 'auth_mode' => null
8 );

1. https://swiftmailer.symfony.com

PDF brought to you by Chapter 23: Swiftmailer | 71

generated on April 10, 2019

 • swiftmailer.sender_address: If set, all messages will be delivered with this address as the "return
path" address.
• swiftmailer.delivery_addresses: If not empty, all email messages will be sent to those addresses
instead of being sent to their actual recipients. This is often useful when developing.
• swiftmailer.delivery_whitelist: Used in combination with delivery_addresses. If set, emails
matching any of these patterns will be delivered like normal, as well as being sent to
delivery_addresses.
• swiftmailer.plugins: Array of SwiftMailer plugins.
Example usage:

Listing 23-2 1 $app['swiftmailer.plugins'] = function ($app) {

2 return array(
3 new \Swift_Plugins_PopBeforeSmtpPlugin('pop3.example.com'),
4 );
5 };

Services
• mailer: The mailer instance.
Example usage:

Listing 23-3 1 $message = \Swift_Message::newInstance();

2
3 // ...
4
5 $app['mailer']->send($message);

• swiftmailer.transport: The transport used for e-mail delivery. Defaults to a

Swift_Transport_EsmtpTransport.
• swiftmailer.transport.buffer: StreamBuffer used by the transport.
• swiftmailer.transport.authhandler: Authentication handler used by the transport. Will try the
following by default: CRAM-MD5, login, plaintext.
• swiftmailer.transport.eventdispatcher: Internal event dispatcher used by Swiftmailer.

Registering
Listing 23-4 1 $app->register(new Silex\Provider\SwiftmailerServiceProvider());

Add SwiftMailer as a dependency:

Listing 23-5 1 composer require swiftmailer/swiftmailer

Usage
The Swiftmailer provider provides a mailer service:

Listing 23-6

PDF brought to you by Chapter 23: Swiftmailer | 72

generated on April 10, 2019

 1 use Symfony\Component\HttpFoundation\Request;
2
3 $app->post('/feedback', function (Request $request) use ($app) {
4 $message = \Swift_Message::newInstance()
5 ->setSubject('[YourSite] Feedback')
6 ->setFrom(array('[email protected]'))
7 ->setTo(array('[email protected]'))
8 ->setBody($request->get('message'));
9
10 $app['mailer']->send($message);
11
12 return new Response('Thank you for your feedback!', 201);
13 });

Usage in commands
By default, the Swiftmailer provider sends the emails using the KernelEvents::TERMINATE event,
which is fired after the response has been sent. However, as this event isn't fired for console commands,
your emails won't be sent.
For that reason, if you send emails using a command console, it is recommended that you disable the use
of the memory spool (before accessing $app['mailer']):

Listing 23-7
$app['swiftmailer.use_spool'] = false;

Alternatively, you can just make sure to flush the message spool by hand before ending the command
execution. To do so, use the following code:

Listing 23-8
$app['swiftmailer.spooltransport']
->getSpool()
->flushQueue($app['swiftmailer.transport'])
;

Traits
Silex\Application\SwiftmailerTrait adds the following shortcuts:
• mail: Sends an email.

Listing 23-9 1 $app->mail(\Swift_Message::newInstance()

2 ->setSubject('[YourSite] Feedback')
3 ->setFrom(array('[email protected]'))
4 ->setTo(array('[email protected]'))
5 ->setBody($request->get('message')));

For more information, check out the Swift Mailer documentation2.

2. https://swiftmailer.symfony.com

PDF brought to you by Chapter 23: Swiftmailer | 73

generated on April 10, 2019

 Chapter 24
Locale

The LocaleServiceProvider manages the locale of an application.

Parameters
• locale: The locale of the user. When set before any request handling, it defines the default locale (en
by default). When a request is being handled, it is automatically set according to the _locale request
attribute of the current route.

Services
• n/a

Registering
Listing 24-1 1 $app->register(new Silex\Provider\LocaleServiceProvider());

PDF brought to you by Chapter 24: Locale | 74

generated on April 10, 2019

 Chapter 25
Translation

The TranslationServiceProvider provides a service for translating your application into different
languages.

Parameters
• translator.domains (optional): A mapping of domains/locales/messages. This parameter contains
the translation data for all languages and domains.
• locale (optional): The locale for the translator. You will most likely want to set this based on some
request parameter. Defaults to en.
• locale_fallbacks (optional): Fallback locales for the translator. It will be used when the current
locale has no messages set. Defaults to en.
• translator.cache_dir (optional): Defines the cache directory if you want translations to be cached.

Services
• translator: An instance of Translator1, that is used for translation.
• translator.loader: An instance of an implementation of the translation LoaderInterface2, defaults
to an ArrayLoader3.
• translator.message_selector: An instance of MessageSelector4.

Registering
Listing 25-1 1 $app->register(new Silex\Provider\LocaleServiceProvider());
2 $app->register(new Silex\Provider\TranslationServiceProvider(), array(

1. https://api.symfony.com/master/Symfony/Component/Translation/Translator.html
2. https://api.symfony.com/master/Symfony/Component/Translation/Loader/LoaderInterface.html
3. https://api.symfony.com/master/Symfony/Component/Translation/Loader/ArrayLoader.html
4. https://api.symfony.com/master/Symfony/Component/Translation/MessageSelector.html

PDF brought to you by Chapter 25: Translation | 75

generated on April 10, 2019

 3 'locale_fallbacks' => array('en'),
4 ));

Add the Symfony Translation Component as a dependency:

Listing 25-2 1 composer require symfony/translation

Usage
The Translation provider provides a translator service and makes use of the translator.domains
parameter:

Listing 25-3 1 $app['translator.domains'] = array(

2 'messages' => array(
3 'en' => array(
4 'hello' => 'Hello %name%',
5 'goodbye' => 'Goodbye %name%',
6 ),
7 'de' => array(
8 'hello' => 'Hallo %name%',
9 'goodbye' => 'Tschüss %name%',
10 ),
11 'fr' => array(
12 'hello' => 'Bonjour %name%',
13 'goodbye' => 'Au revoir %name%',
14 ),
15 ),
16 'validators' => array(
17 'fr' => array(
18 'This value should be a valid number.' => 'Cette valeur doit être un nombre.',
19 ),
20 ),
21 );
22
23 $app->get('/{_locale}/{message}/{name}', function ($message, $name) use ($app) {
24 return $app['translator']->trans($message, array('%name%' => $name));
25 });

The above example will result in following routes:

• /en/hello/igor will return Hello igor.

• /de/hello/igor will return Hallo igor.
• /fr/hello/igor will return Bonjour igor.
• /it/hello/igor will return Hello igor (because of the fallback).

Using Resources
When translations are stored in a file, you can load them as follows:

Listing 25-4 1 $app = new Application();

2
3 $app->register(new TranslationServiceProvider());
4 $app->extend('translator.resources', function ($resources, $app) {
5 $resources = array_merge($resources, array(
6 array('array', array('This value should be a valid number.' => 'Cette valeur doit être un nombre.'),
7 'fr', 'validators'),
8 ));

PDF brought to you by Chapter 25: Translation | 76

generated on April 10, 2019

 9 return $resources;
10 });

Traits
Silex\Application\TranslationTrait adds the following shortcuts:
• trans: Translates the given message.
• transChoice: Translates the given choice message by choosing a translation according to a number.

Listing 25-5 1 $app->trans('Hello World');

2
3 $app->transChoice('Hello World');

Recipes
YAML-based language files
Having your translations in PHP files can be inconvenient. This recipe will show you how to load
translations from external YAML files.
First, add the Symfony Config and Yaml components as dependencies:

Listing 25-6 1 composer require symfony/config symfony/yaml

Next, you have to create the language mappings in YAML files. A naming you can use is locales/
en.yml. Just do the mapping in this file as follows:
Listing 25-7 1 hello: Hello %name%
2 goodbye: Goodbye %name%

Then, register the YamlFileLoader on the translator and add all your translation files:

Listing 25-8 1 use Symfony\Component\Translation\Loader\YamlFileLoader;

2
3 $app->extend('translator', function($translator, $app) {
4 $translator->addLoader('yaml', new YamlFileLoader());
5
6 $translator->addResource('yaml', __DIR__.'/locales/en.yml', 'en');
7 $translator->addResource('yaml', __DIR__.'/locales/de.yml', 'de');
8 $translator->addResource('yaml', __DIR__.'/locales/fr.yml', 'fr');
9
10 return $translator;
11 });

XLIFF-based language files

Just as you would do with YAML translation files, you first need to add the Symfony Config component
as a dependency (see above for details).
Then, similarly, create XLIFF files in your locales directory and add them to the translator:

Listing 25-9

PDF brought to you by Chapter 25: Translation | 77

generated on April 10, 2019

 $translator->addResource('xliff', __DIR__.'/locales/en.xlf', 'en');
$translator->addResource('xliff', __DIR__.'/locales/de.xlf', 'de');
$translator->addResource('xliff', __DIR__.'/locales/fr.xlf', 'fr');

The XLIFF loader is already pre-configured by the extension.

Accessing translations in Twig templates

Once loaded, the translation service provider is available from within Twig templates when using the
Twig bridge provided by Symfony (see TwigServiceProvider):

Listing 25-10 1 {{ 'translation_key'|trans }}

2 {{ 'translation_key'|transchoice }}
3 {% trans %}translation_key{% endtrans %}

PDF brought to you by Chapter 25: Translation | 78

generated on April 10, 2019

 Chapter 26
Validator

The ValidatorServiceProvider provides a service for validating data. It is most useful when used with the
FormServiceProvider, but can also be used standalone.

Parameters
• validator.validator_service_ids (optional): An array of service names representing validators.
• validator.translation_domain (optional): The translation domain to use for translating validator
messages. (Defaults to validators.)
• validator.object_initializers (optional): An array of object initializers. See the relevant Validation
documentation1.

Services
• validator: An instance of Validator2.
• validator.mapping.class_metadata_factory: Factory for metadata loaders, which can read
validation constraint information from classes. Defaults to StaticMethodLoader--
ClassMetadataFactory.
This means you can define a static loadValidatorMetadata method on your data class, which
takes a ClassMetadata argument. Then you can set constraints on this ClassMetadata instance.

Registering
Listing 26-1 1 $app->register(new Silex\Provider\ValidatorServiceProvider());

1. https://symfony.com/doc/current/reference/dic_tags.html#validator-initializer
2. https://api.symfony.com/master/Symfony/Component/Validator/ValidatorInterface.html

PDF brought to you by Chapter 26: Validator | 79

generated on April 10, 2019

 Add the Symfony Validator Component as a dependency:

Listing 26-2 1 composer require symfony/validator

Usage
The Validator provider provides a validator service.

Validating Values
You can validate values directly using the validate validator method:

Listing 26-3 1 use Symfony\Component\Validator\Constraints as Assert;

2
3 $app->get('/validate/{email}', function ($email) use ($app) {
4 $errors = $app['validator']->validate($email, new Assert\Email());
5
6 if (count($errors) > 0) {
7 return (string) $errors;
8 } else {
9 return 'The email is valid';
10 }
11 });

Validating Associative Arrays

Validating associative arrays is like validating simple values, with a collection of constraints:

Listing 26-4 1 use Symfony\Component\Validator\Constraints as Assert;

2
3 $book = array(
4 'title' => 'My Book',
5 'author' => array(
6 'first_name' => 'Fabien',
7 'last_name' => 'Potencier',
8 ),
9 );
10
11 $constraint = new Assert\Collection(array(
12 'title' => new Assert\Length(array('min' => 10)),
13 'author' => new Assert\Collection(array(
14 'first_name' => array(new Assert\NotBlank(), new Assert\Length(array('min' => 10))),
15 'last_name' => new Assert\Length(array('min' => 10)),
16 )),
17 ));
18 $errors = $app['validator']->validate($book, $constraint);
19
20 if (count($errors) > 0) {
21 foreach ($errors as $error) {
22 echo $error->getPropertyPath().' '.$error->getMessage()."\n";
23 }
24 } else {
25 echo 'The book is valid';
26 }

Validating Objects
If you want to add validations to a class, you can define the constraint for the class properties and getters,
and then call the validate method:

PDF brought to you by Chapter 26: Validator | 80

generated on April 10, 2019

Listing 26-5 1 use Symfony\Component\Validator\Constraints as Assert;
2
3 class Book
4 {
5 public $title;
6 public $author;
7 }
8
9 class Author
10 {
11 public $first_name;
12 public $last_name;
13 }
14
15 $author = new Author();
16 $author->first_name = 'Fabien';
17 $author->last_name = 'Potencier';
18
19 $book = new Book();
20 $book->title = 'My Book';
21 $book->author = $author;
22
23 $metadata = $app['validator.mapping.class_metadata_factory']->getMetadataFor('Author');
24 $metadata->addPropertyConstraint('first_name', new Assert\NotBlank());
25 $metadata->addPropertyConstraint('first_name', new Assert\Length(array('min' => 10)));
26 $metadata->addPropertyConstraint('last_name', new Assert\Length(array('min' => 10)));
27
28 $metadata = $app['validator.mapping.class_metadata_factory']->getMetadataFor('Book');
29 $metadata->addPropertyConstraint('title', new Assert\Length(array('min' => 10)));
30 $metadata->addPropertyConstraint('author', new Assert\Valid());
31
32 $errors = $app['validator']->validate($book);
33
34 if (count($errors) > 0) {
35 foreach ($errors as $error) {
36 echo $error->getPropertyPath().' '.$error->getMessage()."\n";
37 }
38 } else {
39 echo 'The author is valid';
40 }

You can also declare the class constraint by adding a static loadValidatorMetadata method to your
classes:

Listing 26-6 1 use Symfony\Component\Validator\Mapping\ClassMetadata;

2 use Symfony\Component\Validator\Constraints as Assert;
3
4 class Book
5 {
6 public $title;
7 public $author;
8
9 static public function loadValidatorMetadata(ClassMetadata $metadata)
10 {
11 $metadata->addPropertyConstraint('title', new Assert\Length(array('min' => 10)));
12 $metadata->addPropertyConstraint('author', new Assert\Valid());
13 }
14 }
15
16 class Author
17 {
18 public $first_name;
19 public $last_name;
20
21 static public function loadValidatorMetadata(ClassMetadata $metadata)
22 {
23 $metadata->addPropertyConstraint('first_name', new Assert\NotBlank());
24 $metadata->addPropertyConstraint('first_name', new Assert\Length(array('min' => 10)));
25 $metadata->addPropertyConstraint('last_name', new Assert\Length(array('min' => 10)));
26 }

PDF brought to you by Chapter 26: Validator | 81

generated on April 10, 2019

 27 }
28
29 $app->get('/validate/{email}', function ($email) use ($app) {
30 $author = new Author();
31 $author->first_name = 'Fabien';
32 $author->last_name = 'Potencier';
33
34 $book = new Book();
35 $book->title = 'My Book';
36 $book->author = $author;
37
38 $errors = $app['validator']->validate($book);
39
40 if (count($errors) > 0) {
41 foreach ($errors as $error) {
42 echo $error->getPropertyPath().' '.$error->getMessage()."\n";
43 }
44 } else {
45 echo 'The author is valid';
46 }
47 });

Use addGetterConstraint() to add constraints on getter methods and addConstraint() to

add constraints on the class itself.

Translation
To be able to translate the error messages, you can use the translator provider and register the messages
under the validators domain:

Listing 26-7 1 $app['translator.domains'] = array(

2 'validators' => array(
3 'fr' => array(
4 'This value should be a valid number.' => 'Cette valeur doit être un nombre.',
5 ),
6 ),
7 );

For more information, consult the Symfony Validation documentation3.

3. https://symfony.com/doc/master/book/validation.html

PDF brought to you by Chapter 26: Validator | 82

generated on April 10, 2019

 Chapter 27
Form

The FormServiceProvider provides a service for building forms in your application with the Symfony
Form component.

Parameters
• none

Services
• form.factory: An instance of FormFactory1, that is used to build a form.

Registering
Listing 27-1 1 use Silex\Provider\FormServiceProvider;
2
3 $app->register(new FormServiceProvider());

If you don't want to create your own form layout, it's fine: a default one will be used. But you will
have to register the translation provider as the default form layout requires it:
$app->register(new Silex\Provider\TranslationServiceProvider(), array(
Listing 27-2
'translator.domains' => array(),
));

If you want to use validation with forms, do not forget to register the Validator provider.

1. https://api.symfony.com/master/Symfony/Component/Form/FormFactory.html

PDF brought to you by Chapter 27: Form | 83

generated on April 10, 2019

 Add the Symfony Form Component as a dependency:

Listing 27-3 1 composer require symfony/form

If you are going to use the validation extension with forms, you must also add a dependency to the
symfony/validator and symfony/config components:

Listing 27-4 1 composer require symfony/validator symfony/config

If you want to use forms in your Twig templates, you can also install the Symfony Twig Bridge. Make
sure to install, if you didn't do that already, the Translation component in order for the bridge to
work:

Listing 27-5 1 composer require symfony/twig-bridge

Usage
The FormServiceProvider provides a form.factory service. Here is a usage example:

Listing 27-6 1 use Symfony\Component\Form\Extension\Core\Type\ChoiceType;

2 use Symfony\Component\Form\Extension\Core\Type\FormType;
3 use Symfony\Component\Form\Extension\Core\Type\SubmitType;
4
5 $app->match('/form', function (Request $request) use ($app) {
6 // some default data for when the form is displayed the first time
7 $data = array(
8 'name' => 'Your name',
9 'email' => 'Your email',
10 );
11
12 $form = $app['form.factory']->createBuilder(FormType::class, $data)
13 ->add('name')
14 ->add('email')
15 ->add('billing_plan', ChoiceType::class, array(
16 'choices' => array('free' => 1, 'small business' => 2, 'corporate' => 3),
17 'expanded' => true,
18 ))
19 ->add('submit', SubmitType::class, [
20 'label' => 'Save',
21 ])
22 ->getForm();
23
24 $form->handleRequest($request);
25
26 if ($form->isValid()) {
27 $data = $form->getData();
28
29 // do something with the data
30
31 // redirect somewhere
32 return $app->redirect('...');
33 }
34
35 // display the form
36 return $app['twig']->render('index.twig', array('form' => $form->createView()));
37 });

And here is the index.twig form template (requires symfony/twig-bridge):

Listing 27-7 1 <form action="#" method="post">

2 {{ form_widget(form) }}
3

PDF brought to you by Chapter 27: Form | 84

generated on April 10, 2019

 4 <input type="submit" name="submit" />
5 </form>

If you are using the validator provider, you can also add validation to your form by adding constraints on
the fields:

Listing 27-8 1 use Symfony\Component\Form\Extension\Core\Type\ChoiceType;

2 use Symfony\Component\Form\Extension\Core\Type\FormType;
3 use Symfony\Component\Form\Extension\Core\Type\SubmitType;
4 use Symfony\Component\Form\Extension\Core\Type\TextType;
5 use Symfony\Component\Validator\Constraints as Assert;
6
7 $app->register(new Silex\Provider\ValidatorServiceProvider());
8 $app->register(new Silex\Provider\TranslationServiceProvider(), array(
9 'translator.domains' => array(),
10 ));
11
12 $form = $app['form.factory']->createBuilder(FormType::class)
13 ->add('name', TextType::class, array(
14 'constraints' => array(new Assert\NotBlank(), new Assert\Length(array('min' => 5)))
15 ))
16 ->add('email', TextType::class, array(
17 'constraints' => new Assert\Email()
18 ))
19 ->add('billing_plan', ChoiceType::class, array(
20 'choices' => array('free' => 1, 'small business' => 2, 'corporate' => 3),
21 'expanded' => true,
22 'constraints' => new Assert\Choice(array(1, 2, 3)),
23 ))
24 ->add('submit', SubmitType::class, [
25 'label' => 'Save',
26 ])
27 ->getForm();

You can register form types by extending form.types:

Listing 27-9 1 $app['your.type.service'] = function ($app) {

2 return new YourServiceFormType();
3 };
4 $app->extend('form.types', function ($types) use ($app) {
5 $types[] = new YourFormType();
6 $types[] = 'your.type.service';
7
8 return $types;
9 });

You can register form extensions by extending form.extensions:

Listing 27-10 1 $app->extend('form.extensions', function ($extensions) use ($app) {

2 $extensions[] = new YourTopFormExtension();
3
4 return $extensions;
5 });

You can register form type extensions by extending form.type.extensions:

Listing 27-11 1 $app['your.type.extension.service'] = function ($app) {

2 return new YourServiceFormTypeExtension();
3 };
4 $app->extend('form.type.extensions', function ($extensions) use ($app) {
5 $extensions[] = new YourFormTypeExtension();
6 $extensions[] = 'your.type.extension.service';
7
8 return $extensions;
9 });

PDF brought to you by Chapter 27: Form | 85

generated on April 10, 2019

 You can register form type guessers by extending form.type.guessers:

Listing 27-12 1 $app['your.type.guesser.service'] = function ($app) {

2 return new YourServiceFormTypeGuesser();
3 };
4 $app->extend('form.type.guessers', function ($guessers) use ($app) {
5 $guessers[] = new YourFormTypeGuesser();
6 $guessers[] = 'your.type.guesser.service';
7
8 return $guessers;
9 });

CSRF protection is only available and automatically enabled when the CSRF Service Provider is
registered.

Traits
Silex\Application\FormTrait adds the following shortcuts:
• form: Creates a FormBuilderInterface instance.
• namedForm: Creates a FormBuilderInterface instance (named).

Listing 27-13 1 $app->form($data);

2
3 $app->namedForm($name, $data, $options, $type);

For more information, consult the Symfony Forms documentation2.

2. https://symfony.com/doc/current/forms.html

PDF brought to you by Chapter 27: Form | 86

generated on April 10, 2019

 Chapter 28
CSRF

The CsrfServiceProvider provides a service for building forms in your application with the Symfony Form
component.

Parameters
• csrf.session_namespace (optional): The namespace under which the token is stored in the session.
Defaults to _csrf.

Services
• csrf.token_manager: An instance of an implementation of the CsrfTokenManagerInterface1,

Registering
Listing 28-1 1 use Silex\Provider\CsrfServiceProvider;
2
3 $app->register(new CsrfServiceProvider());

Add the Symfony's Security CSRF Component2 as a dependency:

Listing 28-2 1 composer require symfony/security-csrf

1. https://api.symfony.com/master/Symfony/Component/Security/Csrf/CsrfTokenManagerInterface.html
2. https://symfony.com/doc/current/components/security/index.html

PDF brought to you by Chapter 28: CSRF | 87

generated on April 10, 2019

 Usage
When the CSRF Service Provider is registered, all forms created via the Form Service Provider are
protected against CSRF by default.
You can also use the CSRF protection without using the Symfony Form component. If, for example,
you're doing a DELETE action, create a CSRF token to use in your code:

Listing 28-3
use Symfony\Component\Security\Csrf\CsrfToken;
$csrfToken = $app['csrf.token_manager']->getToken('token_id'); //'TOKEN'

Then check it:

Listing 28-4
$app['csrf.token_manager']->isTokenValid(new CsrfToken('token_id', 'TOKEN'));

PDF brought to you by Chapter 28: CSRF | 88

generated on April 10, 2019

 Chapter 29
HTTP Cache

The HttpCacheServiceProvider provides support for the Symfony Reverse Proxy.

Parameters
• http_cache.cache_dir: The cache directory to store the HTTP cache data.
• http_cache.options (optional): An array of options for the HttpCache1 constructor.

Services
• http_cache: An instance of HttpCache2.
• http_cache.esi: An instance of Esi3, that implements the ESI capabilities to Request and Response
instances.
• http_cache.store: An instance of Store4, that implements all the logic for storing cache metadata
(Request and Response headers).

Registering
Listing 29-1 1 $app->register(new Silex\Provider\HttpCacheServiceProvider(), array(
2 'http_cache.cache_dir' => __DIR__.'/cache/',
3 ));

1. https://api.symfony.com/master/Symfony/Component/HttpKernel/HttpCache/HttpCache.html
2. https://api.symfony.com/master/Symfony/Component/HttpKernel/HttpCache/HttpCache.html
3. https://api.symfony.com/master/Symfony/Component/HttpKernel/HttpCache/Esi.html
4. https://api.symfony.com/master/Symfony/Component/HttpKernel/HttpCache/Store.html

PDF brought to you by Chapter 29: HTTP Cache | 89

generated on April 10, 2019

 Usage
Silex already supports any reverse proxy like Varnish out of the box by setting Response HTTP cache
headers:

Listing 29-2 1 use Symfony\Component\HttpFoundation\Response;

2
3 $app->get('/', function() {
4 return new Response('Foo', 200, array(
5 'Cache-Control' => 's-maxage=5',
6 ));
7 });

If you want Silex to trust the X-Forwarded-For* headers from your reverse proxy at address $ip,
you will need to whitelist it as documented in Trusting Proxies5.
If you would be running Varnish in front of your application on the same machine:
use Symfony\Component\HttpFoundation\Request;
Listing 29-3

Request::setTrustedProxies(array('127.0.0.1', '::1'));
$app->run();

This provider allows you to use the Symfony reverse proxy natively with Silex applications by using the
http_cache service. The Symfony reverse proxy acts much like any other proxy would, so you will
want to whitelist it:

Listing 29-4
use Symfony\Component\HttpFoundation\Request;

Request::setTrustedProxies(array('127.0.0.1'));
$app['http_cache']->run();

The provider also provides ESI support:

Listing 29-5 1 $app->get('/', function() {

2 $response = new Response(<<<EOF
3 <html>
4 <body>
5 Hello
6 <esi:include src="/included" />
7 </body>
8 </html>
9
10 EOF
11 , 200, array(
12 'Surrogate-Control' => 'content="ESI/1.0"',
13 ));
14
15 $response->setTtl(20);
16
17 return $response;
18 });
19
20 $app->get('/included', function() {
21 $response = new Response('Foo');
22 $response->setTtl(5);
23
24 return $response;
25 });
26
27 $app['http_cache']->run();

If your application doesn't use ESI, you can disable it to slightly improve the overall performance:

5. https://symfony.com/doc/current/components/http_foundation/trusting_proxies.html

PDF brought to you by Chapter 29: HTTP Cache | 90

generated on April 10, 2019

 $app->register(new Silex\Provider\HttpCacheServiceProvider(), array(
Listing 29-6
'http_cache.cache_dir' => __DIR__.'/cache/',
'http_cache.esi' => null,
));

To help you debug caching issues, set your application debug to true. Symfony automatically adds
a X-Symfony-Cache header to each response with useful information about cache hits and misses.
If you are not using the Symfony Session provider, you might want to set the PHP
session.cache_limiter setting to an empty value to avoid the default PHP behavior.
Finally, check that your Web server does not override your caching strategy.

For more information, consult the Symfony HTTP Cache documentation6.

6. https://symfony.com/doc/current/book/http_cache.html

PDF brought to you by Chapter 29: HTTP Cache | 91

generated on April 10, 2019

 Chapter 30
HTTP Fragment

The HttpFragmentServiceProvider provides support for the Symfony fragment sub-framework, which
allows you to embed fragments of HTML in a template.

Parameters
• fragment.path: The path to use for the URL generated for ESI and HInclude URLs (/_fragment by
default).
• uri_signer.secret: The secret to use for the URI signer service (used for the HInclude renderer).
• fragment.renderers.hinclude.global_template: The content or Twig template to use for the
default content when using the HInclude renderer.

Services
• fragment.handler: An instance of FragmentHandler1.
• fragment.renderers: An array of fragment renderers (by default, the inline, ESI, and HInclude
renderers are pre-configured).

Registering
Listing 30-1 1 $app->register(new Silex\Provider\HttpFragmentServiceProvider());

Usage

1. https://api.symfony.com/master/Symfony/Component/HttpKernel/Fragment/FragmentHandler.html

PDF brought to you by Chapter 30: HTTP Fragment | 92

generated on April 10, 2019

 This section assumes that you are using Twig for your templates.

Instead of building a page out of a single request/controller/template, the fragment framework allows
you to build a page from several controllers/sub-requests/sub-templates by using fragments.
Including "sub-pages" in the main page can be done with the Twig render() function:

Listing 30-2 1 The main page content.

2
3 {{ render('/foo') }}
4
5 The main page content resumes here.

The render() call is replaced by the content of the /foo URL (internally, a sub-request is handled by
Silex to render the sub-page).
Instead of making internal sub-requests, you can also use the ESI (the sub-request is handled by a reverse
proxy) or the HInclude strategies (the sub-request is handled by a web browser):

Listing 30-3 1 {{ render(url('route_name')) }}

2
3 {{ render_esi(url('route_name')) }}
4
5 {{ render_hinclude(url('route_name')) }}

PDF brought to you by Chapter 30: HTTP Fragment | 93

generated on April 10, 2019

 Chapter 31
Security

The SecurityServiceProvider manages authentication and authorization for your applications.

Parameters
• security.hide_user_not_found (optional): Defines whether to hide user not found exception or
not. Defaults to true.
• security.encoder.bcrypt.cost (optional): Defines BCrypt password encoder cost. Defaults to 13.
• security.role_hierarchy:(optional): Defines a map of roles including other roles.
• security.access_rules (optional): Defines rules based on paths and roles. See Defining Access Rule1.

Services
• security.token_storage: Gives access to the user token.
• security.authorization_checker: Allows to check authorizations for the users.
• security.authentication_manager: An instance of AuthenticationProviderManager2, responsible
for authentication.
• security.access_manager: An instance of AccessDecisionManager3, responsible for authorization.
• security.session_strategy: Define the session strategy used for authentication (default to a
migration strategy).
• security.user_checker: Checks user flags after authentication.
• security.last_error: Returns the last authentication error message when given a Request object.
• security.authentication_utils: Returns the AuthenticationUtils service allowing you to get last
authentication exception or last username.
• security.encoder_factory: Defines the encoding strategies for user passwords (uses
security.default_encoder).
• security.default_encoder: The encoder to use by default for all users (BCrypt).
• security.encoder.digest: Digest password encoder.

1. #defining-access-rules
2. https://api.symfony.com/master/Symfony/Component/Security/Core/Authentication/AuthenticationProviderManager.html
3. https://api.symfony.com/master/Symfony/Component/Security/Core/Authorization/AccessDecisionManager.html

PDF brought to you by Chapter 31: Security | 94

generated on April 10, 2019

 • security.encoder.bcrypt: BCrypt password encoder.
• security.encoder.pbkdf2: Pbkdf2 password encoder.
• user: Returns the current user

The service provider defines many other services that are used internally but rarely need to be
customized.

Registering
Listing 31-1 1 $app->register(new Silex\Provider\SecurityServiceProvider(), array(
2 'security.firewalls' => // see below
3 ));

Add the Symfony Security Component as a dependency:

Listing 31-2 1 composer require symfony/security

If you're using a form to authenticate users, you need to enable SessionServiceProvider.

The security features are only available after the Application has been booted. So, if you want to use
it outside of the handling of a request, don't forget to call boot() first:
$app->boot();
Listing 31-3

Usage
The Symfony Security component is powerful. To learn more about it, read the Symfony Security
documentation4.

When a security configuration does not behave as expected, enable logging (with the Monolog
extension for instance) as the Security Component logs a lot of interesting information about what it
does and why.

Below is a list of recipes that cover some common use cases.

Accessing the current User

The current user information is stored in a token that is accessible via the security service:

Listing 31-4
$token = $app['security.token_storage']->getToken();

If there is no information about the user, the token is null. If the user is known, you can get it with a
call to getUser():

4. https://symfony.com/doc/current/security.html

PDF brought to you by Chapter 31: Security | 95

generated on April 10, 2019

 if (null !== $token) {
Listing 31-5
$user = $token->getUser();
}

The user can be a string, an object with a __toString() method, or an instance of UserInterface5.

Securing a Path with HTTP Authentication

The following configuration uses HTTP basic authentication to secure URLs under /admin/:

Listing 31-6 1 $app['security.firewalls'] = array(

2 'admin' => array(
3 'pattern' => '^/admin',
4 'http' => true,
5 'users' => array(
6 // raw password is foo
7 'admin' => array('ROLE_ADMIN', '$2y$10$3i9/lVd8UOFIJ6PAMFt8gu3/r5g0qeCJvoSlLCsvMTythye19F77a'),
8 ),
9 ),
10 );

The pattern is a regular expression on the URL path; the http setting tells the security layer to use
HTTP basic authentication and the users entry defines valid users.
If you want to restrict the firewall by more than the URL pattern (like the HTTP method, the client IP,
the hostname, or any Request attributes), use an instance of a RequestMatcher6 for the pattern option:

Listing 31-7 1 use Symfony\Component\HttpFoundation\RequestMatcher;

2
3 $app['security.firewalls'] = array(
4 'admin' => array(
5 'pattern' => new RequestMatcher('^/admin', 'example.com', 'POST'),
6 // ...
7 ),
8 );

Each user is defined with the following information:

• The role or an array of roles for the user (roles are strings beginning with ROLE_ and ending with
anything you want);
• The user encoded password.

All users must at least have one role associated with them.

The default configuration of the extension enforces encoded passwords. To generate a valid encoded
password from a raw password, use the security.encoder_factory service:

Listing 31-8 1 // find the encoder for a UserInterface instance

2 $encoder = $app['security.encoder_factory']->getEncoder($user);
3
4 // compute the encoded password for foo
5 $password = $encoder->encodePassword('foo', $user->getSalt());

When the user is authenticated, the user stored in the token is an instance of User7

5. https://api.symfony.com/master/Symfony/Component/Security/Core/User/UserInterface.html
6. https://api.symfony.com/master/Symfony/Component/HttpFoundation/RequestMatcher.html
7. https://api.symfony.com/master/Symfony/Component/Security/Core/User/User.html

PDF brought to you by Chapter 31: Security | 96

generated on April 10, 2019

 If you are using php-cgi under Apache, you need to add this configuration to make things work
correctly:

Listing 31-9 1 RewriteEngine On

2 RewriteCond %{HTTP:Authorization} ^(.+)$
3 RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
4 RewriteCond %{REQUEST_FILENAME} !-f
5 RewriteRule ^(.*)$ app.php [QSA,L]

Securing a Path with a Form

Using a form to authenticate users is very similar to the above configuration. Instead of using the http
setting, use the form one and define these two parameters:

• login_path: The login path where the user is redirected when they are accessing a secured area
without being authenticated so that they can enter their credentials;
• check_path: The check URL used by Symfony to validate the credentials of the user.

Here is how to secure all URLs under /admin/ with a form:

Listing 31-10 1 $app['security.firewalls'] = array(

2 'admin' => array(
3 'pattern' => '^/admin/',
4 'form' => array('login_path' => '/login', 'check_path' => '/admin/login_check'),
5 'users' => array(
6 'admin' => array('ROLE_ADMIN', '$2y$10$3i9/lVd8UOFIJ6PAMFt8gu3/r5g0qeCJvoSlLCsvMTythye19F77a'),
7 ),
8 ),
9 );

Always keep in mind the following two golden rules:

• The login_path path must always be defined outside the secured area (or if it is in the secured area,
the anonymous authentication mechanism must be enabled -- see below);
• The check_path path must always be defined inside the secured area.

For the login form to work, create a controller like the following:

Listing 31-11 1 use Symfony\Component\HttpFoundation\Request;

2
3 $app->get('/login', function(Request $request) use ($app) {
4 return $app['twig']->render('login.html', array(
5 'error' => $app['security.last_error']($request),
6 'last_username' => $app['session']->get('_security.last_username'),
7 ));
8 });

The error and last_username variables contain the last authentication error and the last username
entered by the user in case of an authentication error.
If you want to have the last error message translated, you would need to use the
security.authentication_utils service and retrieve the actual AuthenticationException
instance.
Create the associated template:

Listing 31-12 1 <form action="{{ path('admin_login_check') }}" method="post">

2 {{ error }}
3 <input type="text" name="_username" value="{{ last_username }}" />
4 <input type="password" name="_password" value="" />

PDF brought to you by Chapter 31: Security | 97

generated on April 10, 2019

 5 <input type="submit" />
6 </form>

The admin_login_check route is automatically defined by Silex and its name is derived from the
check_path value (all / are replaced with _ and the leading / is stripped).

Defining more than one Firewall

You are not limited to define one firewall per project.
Configuring several firewalls is useful when you want to secure different parts of your website with
different authentication strategies or for different users (like using an HTTP basic authentication for the
website API and a form to secure your website administration area).
It's also useful when you want to secure all URLs except the login form:

Listing 31-13 1 $app['security.firewalls'] = array(

2 'login' => array(
3 'pattern' => '^/login$',
4 ),
5 'secured' => array(
6 'pattern' => '^.*$',
7 'form' => array('login_path' => '/login', 'check_path' => '/login_check'),
8 'users' => array(
9 'admin' => array('ROLE_ADMIN', '$2y$10$3i9/lVd8UOFIJ6PAMFt8gu3/r5g0qeCJvoSlLCsvMTythye19F77a'),
10 ),
11 ),
12 );

The order of the firewall configurations is significant as the first one to match wins. The above
configuration first ensures that the /login URL is not secured (no authentication settings), and then it
secures all other URLs.

You can toggle all registered authentication mechanisms for a particular area on and off with the
security flag:

Listing 31-14 1 $app['security.firewalls'] = array(

2 'api' => array(
3 'pattern' => '^/api',
4 'security' => $app['debug'] ? false : true,
5 'wsse' => true,
6
7 // ...
8 ),
9 );

Adding a Logout
When using a form for authentication, you can let users log out if you add the logout setting, where
logout_path must match the main firewall pattern:
Listing 31-15 1 $app['security.firewalls'] = array(
2 'secured' => array(
3 'pattern' => '^/admin/',
4 'form' => array('login_path' => '/login', 'check_path' => '/admin/login_check'),
5 'logout' => array('logout_path' => '/admin/logout', 'invalidate_session' => true),
6
7 // ...

PDF brought to you by Chapter 31: Security | 98

generated on April 10, 2019

 8 ),
9 );

A route is automatically generated, based on the configured path (all / are replaced with _ and the
leading / is stripped):

Listing 31-16 1 <a href="{{ path('admin_logout') }}">Logout</a>

Allowing Anonymous Users

When securing only some parts of your website, the user information are not available in non-secured
areas. To make the user accessible in such areas, enabled the anonymous authentication mechanism:

Listing 31-17 1 $app['security.firewalls'] = array(

2 'unsecured' => array(
3 'anonymous' => true,
4
5 // ...
6 ),
7 );

When enabling the anonymous setting, a user will always be accessible from the security context; if the
user is not authenticated, it returns the anon. string.

Checking User Roles

To check if a user is granted some role, use the isGranted() method on the security context:

Listing 31-18
if ($app['security.authorization_checker']->isGranted('ROLE_ADMIN')) {
// ...
}

You can check roles in Twig templates too:

Listing 31-19 1 {% if is_granted('ROLE_ADMIN') %}

2 <a href="/secured?_switch_user=fabien">Switch to Fabien</a>
3 {% endif %}

You can check if a user is "fully authenticated" (not an anonymous user for instance) with the special
IS_AUTHENTICATED_FULLY role:
Listing 31-20 1 {% if is_granted('IS_AUTHENTICATED_FULLY') %}
2 <a href="{{ path('logout') }}">Logout</a>
3 {% else %}
4 <a href="{{ path('login') }}">Login</a>
5 {% endif %}

Of course you will need to define a login route for this to work.

Don't use the getRoles() method to check user roles.

isGranted() throws an exception when no authentication information is available (which is the

case on non-secured area).

PDF brought to you by Chapter 31: Security | 99

generated on April 10, 2019

 Impersonating a User
If you want to be able to switch to another user (without knowing the user credentials), enable the
switch_user authentication strategy:
Listing 31-21 1 $app['security.firewalls'] = array(
2 'unsecured' => array(
3 'switch_user' => array('parameter' => '_switch_user', 'role' => 'ROLE_ALLOWED_TO_SWITCH'),
4
5 // ...
6 ),
7 );

Switching to another user is now a matter of adding the _switch_user query parameter to any URL
when logged in as a user who has the ROLE_ALLOWED_TO_SWITCH role:

Listing 31-22 1 {% if is_granted('ROLE_ALLOWED_TO_SWITCH') %}

2 <a href="?_switch_user=fabien">Switch to user Fabien</a>
3 {% endif %}

You can check that you are impersonating a user by checking the special ROLE_PREVIOUS_ADMIN. This
is useful for instance to allow the user to switch back to their primary account:

Listing 31-23 1 {% if is_granted('ROLE_PREVIOUS_ADMIN') %}

2 You are an admin but you've switched to another user,
3 <a href="?_switch_user=_exit"> exit</a> the switch.
4 {% endif %}

Sharing Security Context between multiple Firewalls

By default, all the firewalls have a different security context. In case you need to share the same security
context between multiple firewalls you can set the context setting for each firewall you want the
context to be shared with.

Listing 31-24 1 $app['security.firewalls'] = array(

2 'login' => array(
3 'context' => 'admin_security',
4 'pattern' => '^/login',
5 // ...
6 ),
7 'secured' => array(
8 'context' => 'admin_security',
9 'pattern' => '^/admin/',
10 'form' => array('login_path' => '/login', 'check_path' => '/admin/login_check'),
11 'users' => array(
12 'admin' => array('ROLE_ADMIN', '$2y$10$3i9/lVd8UOFIJ6PAMFt8gu3/r5g0qeCJvoSlLCsvMTythye19F77a'),
13 ),
14 // ...
15 ),
16 );

Above configuration ensures that you have the same security context admin_security inside both,
login and admin firewalls. This might be useful for instance to redirect already logged in users to the
secured area of your website when they visit the login form, as you have the possibility to check if the
user has been granted the ROLE_ADMIN role inside the login firewall.

Defining a Role Hierarchy

Defining a role hierarchy allows to automatically grant users some additional roles:

Listing 31-25

PDF brought to you by Chapter 31: Security | 100

generated on April 10, 2019

 $app['security.role_hierarchy'] = array(
'ROLE_ADMIN' => array('ROLE_USER', 'ROLE_ALLOWED_TO_SWITCH'),
);

With this configuration, all users with the ROLE_ADMIN role also automatically have the ROLE_USER
and ROLE_ALLOWED_TO_SWITCH roles.

Defining Access Rules

Roles are a great way to adapt the behavior of your website depending on groups of users, but they can
also be used to further secure some areas by defining access rules:

Listing 31-26
$app['security.access_rules'] = array(
array('^/admin', 'ROLE_ADMIN', 'https'),
array('^.*$', 'ROLE_USER'),
);

With the above configuration, users must have the ROLE_ADMIN to access the /admin section of the
website, and ROLE_USER for everything else. Furthermore, the admin section can only be accessible via
HTTPS (if that's not the case, the user will be automatically redirected).

The first argument can also be a RequestMatcher8 instance.

Defining a custom User Provider

Using an array of users is simple and useful when securing an admin section of a personal website, but
you can override this default mechanism with you own.
The users setting can be defined as a service or a service id that returns an instance of
UserProviderInterface9:

Listing 31-27
'users' => function () use ($app) {
return new UserProvider($app['db']);
},

Here is a simple example of a user provider, where Doctrine DBAL is used to store the users:

Listing 31-28 1 use Symfony\Component\Security\Core\User\UserProviderInterface;

2 use Symfony\Component\Security\Core\User\UserInterface;
3 use Symfony\Component\Security\Core\User\User;
4 use Symfony\Component\Security\Core\Exception\UnsupportedUserException;
5 use Symfony\Component\Security\Core\Exception\UsernameNotFoundException;
6 use Doctrine\DBAL\Connection;
7
8 class UserProvider implements UserProviderInterface
9 {
10 private $conn;
11
12 public function __construct(Connection $conn)
13 {
14 $this->conn = $conn;
15 }
16
17 public function loadUserByUsername($username)
18 {
19 $stmt = $this->conn->executeQuery('SELECT * FROM users WHERE username = ?',
20 array(strtolower($username)));
21

8. https://api.symfony.com/master/Symfony/Component/HttpFoundation/RequestMatcher.html
9. https://api.symfony.com/master/Symfony/Component/Security/Core/User/UserProviderInterface.html

PDF brought to you by Chapter 31: Security | 101

generated on April 10, 2019

 22 if (!$user = $stmt->fetch()) {
23 throw new UsernameNotFoundException(sprintf('Username "%s" does not exist.', $username));
24 }
25
26 return new User($user['username'], $user['password'], explode(',', $user['roles']), true, true, true,
27 true);
28 }
29
30 public function refreshUser(UserInterface $user)
31 {
32 if (!$user instanceof User) {
33 throw new UnsupportedUserException(sprintf('Instances of "%s" are not supported.',
34 get_class($user)));
35 }
36
37 return $this->loadUserByUsername($user->getUsername());
38 }
39
40 public function supportsClass($class)
41 {
return $class === 'Symfony\Component\Security\Core\User\User';
}
}

In this example, instances of the default User class are created for the users, but you can define your own
class; the only requirement is that the class must implement UserInterface10
And here is the code that you can use to create the database schema and some sample users:

Listing 31-29 1 use Doctrine\DBAL\Schema\Table;

2
3 $schema = $app['db']->getSchemaManager();
4 if (!$schema->tablesExist('users')) {
5 $users = new Table('users');
6 $users->addColumn('id', 'integer', array('unsigned' => true, 'autoincrement' => true));
7 $users->setPrimaryKey(array('id'));
8 $users->addColumn('username', 'string', array('length' => 32));
9 $users->addUniqueIndex(array('username'));
10 $users->addColumn('password', 'string', array('length' => 255));
11 $users->addColumn('roles', 'string', array('length' => 255));
12
13 $schema->createTable($users);
14
15 $app['db']->insert('users', array(
16 'username' => 'fabien',
17 'password' => '$2y$10$3i9/lVd8UOFIJ6PAMFt8gu3/r5g0qeCJvoSlLCsvMTythye19F77a',
18 'roles' => 'ROLE_USER'
19 ));
20
21 $app['db']->insert('users', array(
22 'username' => 'admin',
23 'password' => '$2y$10$3i9/lVd8UOFIJ6PAMFt8gu3/r5g0qeCJvoSlLCsvMTythye19F77a',
24 'roles' => 'ROLE_ADMIN'
25 ));
26 }

If you are using the Doctrine ORM, the Symfony bridge for Doctrine provides a user provider class
that is able to load users from your entities.

10. https://api.symfony.com/master/Symfony/Component/Security/Core/User/UserInterface.html

PDF brought to you by Chapter 31: Security | 102

generated on April 10, 2019

 Defining a custom Encoder
By default, Silex uses the BCrypt algorithm to encode passwords. Additionally, the password is encoded
multiple times. You can change these defaults by overriding security.default_encoder service to
return one of the predefined encoders:

• security.encoder.digest: Digest password encoder.

• security.encoder.bcrypt: BCrypt password encoder.
• security.encoder.pbkdf2: Pbkdf2 password encoder.

Listing 31-30 1 $app['security.default_encoder'] = function ($app) {

2 return $app['security.encoder.pbkdf2'];
3 };

Or you can define you own, fully customizable encoder:

Listing 31-31 1 use Symfony\Component\Security\Core\Encoder\PlaintextPasswordEncoder;

2
3 $app['security.default_encoder'] = function ($app) {
4 // Plain text (e.g. for debugging)
5 return new PlaintextPasswordEncoder();
6 };

You can change the default BCrypt encoding cost by overriding

security.encoder.bcrypt.cost

Defining a custom Authentication Provider

The Symfony Security component provides a lot of ready-to-use authentication providers (form, HTTP,
X509, remember me, ...), but you can add new ones easily. To register a new authentication provider,
create a service named security.authentication_listener.factory.XXX where XXX is the
name you want to use in your configuration:

Listing 31-32 1 $app['security.authentication_listener.factory.wsse'] = $app->protect(function ($name, $options) use ($app) {

2 // define the authentication provider object
3 $app['security.authentication_provider.'.$name.'.wsse'] = function () use ($app) {
4 return new WsseProvider($app['security.user_provider.default'], __DIR__.'/security_cache');
5 };
6
7 // define the authentication listener object
8 $app['security.authentication_listener.'.$name.'.wsse'] = function () use ($app) {
9 return new WsseListener($app['security.token_storage'], $app['security.authentication_manager']);
10 };
11
12 return array(
13 // the authentication provider id
14 'security.authentication_provider.'.$name.'.wsse',
15 // the authentication listener id
16 'security.authentication_listener.'.$name.'.wsse',
17 // the entry point id
18 null,
19 // the position of the listener in the stack
20 'pre_auth'
21 );
22 });

You can now use it in your configuration like any other built-in authentication provider:

Listing 31-33

PDF brought to you by Chapter 31: Security | 103

generated on April 10, 2019

 1 $app->register(new Silex\Provider\SecurityServiceProvider(), array(
2 'security.firewalls' => array(
3 'default' => array(
4 'wsse' => true,
5
6 // ...
7 ),
8 ),
9 ));

Instead of true, you can also define an array of options that customize the behavior of your
authentication factory; it will be passed as the second argument of your authentication factory (see
above).
This example uses the authentication provider classes as described in the Symfony cookbook11.

The Guard component simplifies the creation of custom authentication providers. How to Create a
Custom Authentication System with Guard

Stateless Authentication
By default, a session cookie is created to persist the security context of the user. However, if you use
certificates, HTTP authentication, WSSE and so on, the credentials are sent for each request. In that case,
you can turn off persistence by activating the stateless authentication flag:

Listing 31-34 1 $app['security.firewalls'] = array(

2 'default' => array(
3 'stateless' => true,
4 'wsse' => true,
5
6 // ...
7 ),
8 );

Traits
Silex\Application\SecurityTrait adds the following shortcuts:
• encodePassword: Encode a given password.

Listing 31-35 1 $encoded = $app->encodePassword($app['user'], 'foo');

Silex\Route\SecurityTrait adds the following methods to the controllers:

• secure: Secures a controller for the given roles.

Listing 31-36 1 $app->get('/', function () {

2 // do something but only for admins
3 })->secure('ROLE_ADMIN');

11. https://symfony.com/doc/current/cookbook/security/custom_authentication_provider.html

PDF brought to you by Chapter 31: Security | 104

generated on April 10, 2019

 The Silex\Route\SecurityTrait must be used with a user defined Route class, not the
application.

Listing 31-37 1 use Silex\Route;

2
3 class MyRoute extends Route
4 {
5 use Route\SecurityTrait;
6 }

Listing 31-38 1 $app['route_class'] = 'MyRoute';

PDF brought to you by Chapter 31: Security | 105

generated on April 10, 2019

 Chapter 32
Remember Me

The RememberMeServiceProvider adds "Remember-Me" authentication to the SecurityServiceProvider.

Parameters
n/a

Services
n/a

The service provider defines many other services that are used internally but rarely need to be
customized.

Registering
Before registering this service provider, you must register the SecurityServiceProvider:

Listing 32-1 1 $app->register(new Silex\Provider\SecurityServiceProvider());

2 $app->register(new Silex\Provider\RememberMeServiceProvider());
3
4 $app['security.firewalls'] = array(
5 'my-firewall' => array(
6 'pattern' => '^/secure$',
7 'form' => true,
8 'logout' => true,
9 'remember_me' => array(
10 'key' => 'Choose_A_Unique_Random_Key',
11 'always_remember_me' => true,
12 /* Other options */
13 ),
14 'users' => array( /* ... */ ),

PDF brought to you by Chapter 32: Remember Me | 106

generated on April 10, 2019

15 ),
16 );

Options
• key: A secret key to generate tokens (you should generate a random string).
• name: Cookie name (default: REMEMBERME).
• lifetime: Cookie lifetime (default: 31536000 ~ 1 year).
• path: Cookie path (default: /).
• domain: Cookie domain (default: null = request domain).
• secure: Cookie is secure (default: false).
• httponly: Cookie is HTTP only (default: true).
• always_remember_me: Enable remember me (default: false).
• remember_me_parameter: Name of the request parameter enabling remember_me on login. To
add the checkbox to the login form. You can find more information in the Symfony cookbook1
(default: _remember_me).

1. https://symfony.com/doc/current/cookbook/security/remember_me.html

PDF brought to you by Chapter 32: Remember Me | 107

generated on April 10, 2019

 Chapter 33
Serializer

The SerializerServiceProvider provides a service for serializing objects.

Parameters
None.

Services
• serializer: An instance of Symfony\Component\Serializer\Serializer1.
• serializer.encoders: Symfony\Component\Serializer\Encoder\JsonEncoder2 and
Symfony\Component\Serializer\Encoder\XmlEncoder3.
• serializer.normalizers: Symfony\Component\Serializer\Normalizer\CustomNormalizer4 and
Symfony\Component\Serializer\Normalizer\GetSetMethodNormalizer5.

Registering
Listing 33-1 1 $app->register(new Silex\Provider\SerializerServiceProvider());

Add the Symfony's Serializer Component6 as a dependency:

Listing 33-2 1 composer require symfony/serializer

1. https://api.symfony.com/master/Symfony/Component/Serializer/Serializer.html
2. https://api.symfony.com/master/Symfony/Component/Serializer/Encoder/JsonEncoder.html
3. https://api.symfony.com/master/Symfony/Component/Serializer/Encoder/XmlEncoder.html
4. https://api.symfony.com/master/Symfony/Component/Serializer/Normalizer/CustomNormalizer.html
5. https://api.symfony.com/master/Symfony/Component/Serializer/Normalizer/GetSetMethodNormalizer.html
6. https://symfony.com/doc/current/components/serializer.html

PDF brought to you by Chapter 33: Serializer | 108

generated on April 10, 2019

 Usage
The SerializerServiceProvider provider provides a serializer service:

Listing 33-3 1 use Silex\Application;

2 use Silex\Provider\SerializerServiceProvider;
3 use Symfony\Component\HttpFoundation\Request;
4 use Symfony\Component\HttpFoundation\Response;
5
6 $app = new Application();
7
8 $app->register(new SerializerServiceProvider());
9
10 // only accept content types supported by the serializer via the assert method.
11 $app->get("/pages/{id}.{_format}", function (Request $request, $id) use ($app) {
12 // assume a page_repository service exists that returns Page objects. The
13 // object returned has getters and setters exposing the state.
14 $page = $app['page_repository']->find($id);
15 $format = $request->getRequestFormat();
16
17 if (!$page instanceof Page) {
18 $app->abort("No page found for id: $id");
19 }
20
21 return new Response($app['serializer']->serialize($page, $format), 200, array(
22 "Content-Type" => $request->getMimeType($format)
23 ));
24 })->assert("_format", "xml|json")
25 ->assert("id", "\d+");

Using a Cache
To use a cache, register a class implementing Doctrine\Common\Cache\Cache:

Listing 33-4 1 $app->register(new Silex\Provider\SerializerServiceProvider());

2 $app['serializer.normalizers'] = function () use ($app) {
3 return [new \Symfony\Component\Serializer\Normalizer\CustomNormalizer(),
4 new \Symfony\Component\Serializer\Normalizer\GetSetMethodNormalizer(new ClassMetadataFactory(new
5 AnnotationLoader(new AnnotationReader()), $app['my_custom_cache']))
6 ];
};

PDF brought to you by Chapter 33: Serializer | 109

generated on April 10, 2019

 Chapter 34
Service Controllers

As your Silex application grows, you may wish to begin organizing your controllers in a more formal
fashion. Silex can use controller classes out of the box, but with a bit of work, your controllers can be
created as services, giving you the full power of dependency injection and lazy loading.

Why would I want to do this?

• Dependency Injection over Service Location
Using this method, you can inject the actual dependencies required by your controller and gain
total inversion of control, while still maintaining the lazy loading of your controllers and its
dependencies. Because your dependencies are clearly defined, they are easily mocked, allowing you
to test your controllers in isolation.
• Framework Independence
Using this method, your controllers start to become more independent of the framework you
are using. Carefully crafted, your controllers will become reusable with multiple frameworks. By
keeping careful control of your dependencies, your controllers could easily become compatible with
Silex, Symfony (full stack) and Drupal, to name just a few.

Parameters
There are currently no parameters for the ServiceControllerServiceProvider.

Services
There are no extra services provided, the ServiceControllerServiceProvider simply extends the
existing resolver service.

PDF brought to you by Chapter 34: Service Controllers | 110

generated on April 10, 2019

 Registering
Listing 34-1 1 $app->register(new Silex\Provider\ServiceControllerServiceProvider());

Usage
In this slightly contrived example of a blog API, we're going to change the /posts.json route to use a
controller, that is defined as a service.

Listing 34-2 1 use Silex\Application;

2 use Demo\Repository\PostRepository;
3
4 $app = new Application();
5
6 $app['posts.repository'] = function() {
7 return new PostRepository;
8 };
9
10 $app->get('/posts.json', function() use ($app) {
11 return $app->json($app['posts.repository']->findAll());
12 });

Rewriting your controller as a service is pretty simple, create a Plain Ol' PHP Object with your
PostRepository as a dependency, along with an indexJsonAction method to handle the request.
Although not shown in the example below, you can use type hinting and parameter naming to get the
parameters you need, just like with standard Silex routes.
If you are a TDD/BDD fan (and you should be), you may notice that this controller has well defined
responsibilities and dependencies, and is easily tested/specced. You may also notice that the only
external dependency is on Symfony\Component\HttpFoundation\JsonResponse, meaning this
controller could easily be used in a Symfony (full stack) application, or potentially with other applications
or frameworks that know how to handle a Symfony/HttpFoundation1 Response object.

Listing 34-3 1 namespace Demo\Controller;

2
3 use Demo\Repository\PostRepository;
4 use Symfony\Component\HttpFoundation\JsonResponse;
5
6 class PostController
7 {
8 protected $repo;
9
10 public function __construct(PostRepository $repo)
11 {
12 $this->repo = $repo;
13 }
14
15 public function indexJsonAction()
16 {
17 return new JsonResponse($this->repo->findAll());
18 }
19 }

And lastly, define your controller as a service in the application, along with your route. The syntax in the
route definition is the name of the service, followed by a single colon (:), followed by the method name.

Listing 34-4

1. https://symfony.com/doc/master/components/http_foundation/introduction.html

PDF brought to you by Chapter 34: Service Controllers | 111

generated on April 10, 2019

 1 $app['posts.controller'] = function() use ($app) {
2 return new PostController($app['posts.repository']);
3 };
4
5 $app->get('/posts.json', "posts.controller:indexJsonAction");

In addition to using classes for service controllers, you can define any callable as a service in the
application to be used for a route.

Listing 34-5 1 namespace Demo\Controller;

2
3 use Demo\Repository\PostRepository;
4 use Symfony\Component\HttpFoundation\JsonResponse;
5
6 function postIndexJson(PostRepository $repo) {
7 return function() use ($repo) {
8 return new JsonResponse($repo->findAll());
9 };
10 }

And when defining your route, the code would look like the following:

Listing 34-6 1 $app['posts.controller'] = function($app) {

2 return Demo\Controller\postIndexJson($app['posts.repository']);
3 };
4
5 $app->get('/posts.json', 'posts.controller');

PDF brought to you by Chapter 34: Service Controllers | 112

generated on April 10, 2019

 Chapter 35
Var Dumper

The VarDumperServiceProvider provides a mechanism that allows exploring then dumping any PHP
variable.

Parameters
• var_dumper.dump_destination: A stream URL where dumps should be written to (defaults to
null).

Services
• n/a

Registering
Listing 35-1 1 $app->register(new Silex\Provider\VarDumperServiceProvider());

Add the Symfony VarDumper Component as a dependency:

Listing 35-2 1 composer require symfony/var-dumper

Usage
Adding the VarDumper component as a Composer dependency gives you access to the dump() PHP
function anywhere in your code.
If you are using Twig, it also provides a dump() Twig function and a dump Twig tag.

PDF brought to you by Chapter 35: Var Dumper | 113

generated on April 10, 2019

The VarDumperServiceProvider is also useful when used with the Silex WebProfiler as the dumps are
made available in the web debug toolbar and in the web profiler.

PDF brought to you by Chapter 35: Var Dumper | 114

generated on April 10, 2019

 Chapter 36
Doctrine

The DoctrineServiceProvider provides integration with the Doctrine DBAL1 for easy database access
(Doctrine ORM integration is not supplied).

Parameters
• db.options: Array of Doctrine DBAL options.
These options are available:

• driver: The database driver to use, defaults to pdo_mysql. Can be any of: pdo_mysql, pdo_sqlite,
pdo_pgsql, pdo_oci, oci8, ibm_db2, pdo_ibm, pdo_sqlsrv.
• dbname: The name of the database to connect to.
• host: The host of the database to connect to. Defaults to localhost.
• user: The user of the database to connect to. Defaults to root.
• password: The password of the database to connect to.
• charset: Only relevant for pdo_mysql, and pdo_oci/oci8, specifies the charset used when
connecting to the database.
• path: Only relevant for pdo_sqlite, specifies the path to the SQLite database.
• port: Only relevant for pdo_mysql, pdo_pgsql, and pdo_oci/oci8, specifies the port of the database to
connect to.

These and additional options are described in detail in the Doctrine DBAL configuration
documentation.

Services
• db: The database connection, instance of Doctrine\DBAL\Connection.
• db.config: Configuration object for Doctrine. Defaults to an empty Doctrine\DBAL\Configuration.
• db.event_manager: Event Manager for Doctrine.

1. https://www.doctrine-project.org/projects/dbal

PDF brought to you by Chapter 36: Doctrine | 115

generated on April 10, 2019

 Registering
Listing 36-1 1 $app->register(new Silex\Provider\DoctrineServiceProvider(), array(
2 'db.options' => array(
3 'driver' => 'pdo_sqlite',
4 'path' => __DIR__.'/app.db',
5 ),
6 ));

Add the Doctrine DBAL as a dependency:

Listing 36-2 1 composer require "doctrine/dbal:~2.2"

Usage
The Doctrine provider provides a db service. Here is a usage example:

Listing 36-3 1 $app->get('/blog/{id}', function ($id) use ($app) {

2 $sql = "SELECT * FROM posts WHERE id = ?";
3 $post = $app['db']->fetchAssoc($sql, array((int) $id));
4
5 return "<h1>{$post['title']}</h1>".
6 "<p>{$post['body']}</p>";
7 });

Using multiple databases

The Doctrine provider can allow access to multiple databases. In order to configure the data sources,
replace the db.options with dbs.options. dbs.options is an array of configurations where keys are
connection names and values are options:

Listing 36-4 1 $app->register(new Silex\Provider\DoctrineServiceProvider(), array(

2 'dbs.options' => array (
3 'mysql_read' => array(
4 'driver' => 'pdo_mysql',
5 'host' => 'mysql_read.someplace.tld',
6 'dbname' => 'my_database',
7 'user' => 'my_username',
8 'password' => 'my_password',
9 'charset' => 'utf8mb4',
10 ),
11 'mysql_write' => array(
12 'driver' => 'pdo_mysql',
13 'host' => 'mysql_write.someplace.tld',
14 'dbname' => 'my_database',
15 'user' => 'my_username',
16 'password' => 'my_password',
17 'charset' => 'utf8mb4',
18 ),
19 ),
20 ));

The first registered connection is the default and can simply be accessed as you would if there was only
one connection. Given the above configuration, these two lines are equivalent:

Listing 36-5

PDF brought to you by Chapter 36: Doctrine | 116

generated on April 10, 2019

 $app['db']->fetchAll('SELECT * FROM table');

$app['dbs']['mysql_read']->fetchAll('SELECT * FROM table');

Using multiple connections:

Listing 36-6 1 $app->get('/blog/{id}', function ($id) use ($app) {

2 $sql = "SELECT * FROM posts WHERE id = ?";
3 $post = $app['dbs']['mysql_read']->fetchAssoc($sql, array((int) $id));
4
5 $sql = "UPDATE posts SET value = ? WHERE id = ?";
6 $app['dbs']['mysql_write']->executeUpdate($sql, array('newValue', (int) $id));
7
8 return "<h1>{$post['title']}</h1>".
9 "<p>{$post['body']}</p>";
10 });

For more information, consult the Doctrine DBAL documentation2.

2. https://docs.doctrine-project.org/projects/doctrine-dbal/en/latest/

PDF brought to you by Chapter 36: Doctrine | 117

generated on April 10, 2019

 Chapter 37
Routing

The RoutingServiceProvider provides a service for generating URLs for named routes.

Parameters
• route_class: (optional): The default route class used by the route factory (defaults to Silex\Route).

Services
• url_generator: An instance of UrlGenerator1, using the RouteCollection2 that is provided through
the routes service. It has a generate method, which takes the route name as an argument, followed by
an array of route parameters.

Registering
Listing 37-1 1 $app->register(new Silex\Provider\RoutingServiceProvider());

Usage
The Routing provider provides a url_generator service:

Listing 37-2 1 $app->get('/', function () {

2 return 'welcome to the homepage';
3 })
4 ->bind('homepage');
5

1. https://api.symfony.com/master/Symfony/Component/Routing/Generator/UrlGenerator.html
2. https://api.symfony.com/master/Symfony/Component/Routing/RouteCollection.html

PDF brought to you by Chapter 37: Routing | 118

generated on April 10, 2019

 6 $app->get('/hello/{name}', function ($name) {
7 return "Hello $name!";
8 })
9 ->bind('hello');
10
11 $app->get('/navigation', function () use ($app) {
12 return '<a href="'.$app['url_generator']->generate('homepage').'">Home</a>'.
13 ' | '.
14 '<a href="'.$app['url_generator']->generate('hello', array('name' => 'Igor')).'">Hello Igor</a>';
15 });

When using Twig, the service can be used like this:

Listing 37-3 1 {{ app.url_generator.generate('homepage') }}

Moreover, if you have twig-bridge as a Composer dep, you will have access to the path() and url()
functions:

Listing 37-4 1 {{ path('homepage') }}

2 {{ url('homepage') }} {# generates the absolute url http://example.org/ #}
3 {{ path('hello', {name: 'Fabien'}) }}
4 {{ url('hello', {name: 'Fabien'}) }} {# generates the absolute url http://example.org/hello/Fabien #}

Traits
Silex\Application\UrlGeneratorTrait adds the following shortcuts:
• path: Generates a path.
• url: Generates an absolute URL.

Listing 37-5 1 $app->path('homepage');

2 $app->url('homepage');

PDF brought to you by Chapter 37: Routing | 119

generated on April 10, 2019

 Chapter 38
Webserver Configuration

Apache
If you are using Apache, make sure mod_rewrite is enabled and use the following .htaccess file:

Listing 38-1 1 <IfModule mod_rewrite.c>

2 Options -MultiViews
3
4 RewriteEngine On
5 #RewriteBase /path/to/app
6 RewriteCond %{REQUEST_FILENAME} !-d
7 RewriteCond %{REQUEST_FILENAME} !-f
8 RewriteRule ^ index.php [QSA,L]
9 </IfModule>

If your site is not at the webroot level you will have to uncomment the RewriteBase statement and
adjust the path to point to your directory, relative from the webroot.

Alternatively, if you use Apache 2.2.16 or higher, you can use the FallbackResource directive1 to make
your .htaccess even easier:

Listing 38-2 1 FallbackResource index.php

If your site is not at the webroot level you will have to adjust the path to point to your directory,
relative from the webroot.

Or if you're using a VirtualHost, you can add the same directive to the VirtualHost's Directory entry:

Listing 38-3

1. https://www.adayinthelifeof.nl/2012/01/21/apaches-fallbackresource-your-new-htaccess-command/

PDF brought to you by Chapter 38: Webserver Configuration | 120

generated on April 10, 2019

 1 <VirtualHost *:80>
2 # other directives
3
4 Alias /app/ /path/to/app/
5 <Directory /path/to/app>
6 # other directives
7
8 FallbackResource /app/index.php
9 </Directory>
10 </VirtualHost>

Note that you need the leading forward slash there, unlike with the .htaccess version

nginx
The minimum configuration to get your application running under Nginx is:

Listing 38-4 1 server {

2 server_name domain.tld www.domain.tld;
3 root /var/www/project/web;
4
5 location / {
6 # try to serve file directly, fallback to front controller
7 try_files $uri /index.php$is_args$args;
8 }
9
10 # If you have 2 front controllers for dev|prod use the following line instead
11 # location ~ ^/(index|index_dev)\.php(/|$) {
12 location ~ ^/index\.php(/|$) {
13 # the ubuntu default
14 fastcgi_pass unix:/var/run/php/phpX.X-fpm.sock;
15 # for running on centos
16 #fastcgi_pass unix:/var/run/php-fpm/www.sock;
17
18 fastcgi_split_path_info ^(.+\.php)(/.*)$;
19 include fastcgi_params;
20 fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
21 fastcgi_param HTTPS off;
22
23 # Prevents URIs that include the front controller. This will 404:
24 # http://domain.tld/index.php/some-path
25 # Enable the internal directive to disable URIs like this
26 # internal;
27 }
28
29 #return 404 for all php files as we do have a front controller
30 location ~ \.php$ {
31 return 404;
32 }
33
34 error_log /var/log/nginx/project_error.log;
35 access_log /var/log/nginx/project_access.log;
36 }

IIS
If you are using the Internet Information Services from Windows, you can use this sample web.config
file:

PDF brought to you by Chapter 38: Webserver Configuration | 121

generated on April 10, 2019

Listing 38-5 1 <?xml version="1.0"?>
2 <configuration>
3 <system.webServer>
4 <defaultDocument>
5 <files>
6 <clear />
7 <add value="index.php" />
8 </files>
9 </defaultDocument>
10 <rewrite>
11 <rules>
12 <rule name="Silex Front Controller" stopProcessing="true">
13 <match url="^(.*)$" ignoreCase="false" />
14 <conditions logicalGrouping="MatchAll">
15 <add input="{REQUEST_FILENAME}" matchType="IsFile" ignoreCase="false" negate="true" />
16 </conditions>
17 <action type="Rewrite" url="index.php" appendQueryString="true" />
18 </rule>
19 </rules>
20 </rewrite>
21 </system.webServer>
22 </configuration>

Lighttpd
If you are using lighttpd, use this sample simple-vhost as a starting point:

Listing 38-6 1 server.document-root = "/path/to/app"

2
3 url.rewrite-once = (
4 # configure some static files
5 "^/assets/.+" => "$0",
6 "^/favicon\.ico$" => "$0",
7
8 "^(/[^\?]*)(\?.*)?" => "/index.php$1$2"
9 )

PHP
PHP ships with a built-in webserver for development. This server allows you to run silex without any
configuration. However, in order to serve static files, you'll have to make sure your front controller
returns false in that case:

Listing 38-7 1 // web/index.php

2
3 $filename = __DIR__.preg_replace('#(\?.*)$#', '', $_SERVER['REQUEST_URI']);
4 if (php_sapi_name() === 'cli-server' && is_file($filename)) {
5 return false;
6 }
7
8 $app = require __DIR__.'/../src/app.php';
9 $app->run();

Assuming your front controller is at web/index.php, you can start the server from the command-line
with this command:

Listing 38-8 1 $ php -S localhost:8080 -t web web/index.php

Now the application should be running at http://localhost:8080.

PDF brought to you by Chapter 38: Webserver Configuration | 122

generated on April 10, 2019

 This server is for development only. It is not recommended to use it in production.

PDF brought to you by Chapter 38: Webserver Configuration | 123

generated on April 10, 2019

 Chapter 39
Changelog

2.3.1 (2018-XX-XX)

• n/a

2.3.0 (2018-04-20)

• added support for defining users provider as a service ID

• fixed error when HttpKernelRuntime is not available
• allow setting custom status code on exception response with Symfony 3.3+
• made CSRF extension work with Validator translations domain
• fixed Security provider context usage
• dropped support for Twig < 2.0
• dropped support for PHP < 7.1
• dropped support for Symfony 2.x and 3.x
• added support for Symfony 4
• added support PSR-3 log levels in MonologServiceProvider
• exposed AuthenticationUtils in SecurityServiceProvider

PDF brought to you by Chapter 39: Changelog | 124

generated on April 10, 2019

2.2.3 (2018-02-25)

• fixed validator integration into the security provider (order of registration of the validator and
security providers does not matter anymore)
• fixed compatibility issues with Symfony 3.4

2.2.2 (2018-01-12)
• [SECURITY] fixed before handlers not executed under mounts

2.2.1 (2017-12-14)
• added support for Swiftmailer SSL stream_context_options option
• fixed usage of namespaces for Twig paths

2.2.0 (2017-07-23)
• added json manifest version strategy support
• fixed EsiFragment constructor
• fixed RedirectableUrlMatcher compatibility with Symfony
• fixed compatibility with Pimple 3.2
• fixed WebTestCase compatibility with PHPUnit 6+

2.1.0 (2017-05-03)
• added more options to security.firewalls
• added WebLink component integration
• added parameters to configure the Twig core extension behavior
• fixed deprecation notices with symfony/twig-bridge 3.2+ in TwigServiceProvider
• added FormRegistry as a service to enable the extension point
• removed the build scripts
• fixed some deprecation warnings
• added support for registering Swiftmailer plugins

2.0.4 (2016-11-06)
• fixed twig.app_variable definition
• added support for latest versions of Twig 1.x and 2.0 (Twig runtime loaders)
• added support for Symfony 2.3

2.0.3 (2016-08-22)
• fixed lazy evaluation of 'monolog.use_error_handler'
• fixed PHP7 type hint on controllers

PDF brought to you by Chapter 39: Changelog | 125

generated on April 10, 2019

2.0.2 (2016-06-14)
• fixed Symfony 3.1 deprecations

2.0.1 (2016-05-27)
• fixed the silex form extension registration to allow overriding default ones
• removed support for the obsolete Locale Symfony component (uses the Intl one now)
• added support for Symfony 3.1

2.0.0 (2016-05-18)
• decoupled the exception handler from HttpKernelServiceProvider
• Switched to BCrypt as the default encoder in the security provider
• added full support for RequestMatcher
• added support for Symfony Guard
• added support for callables in CallbackResolver
• added FormTrait::namedForm()
• added support for delivery_addresses, delivery_whitelist, and sender_address
• added support to register form types / form types extensions / form types guessers as services
• added support for callable in mounts (allow nested route collection to be built easily)
• added support for conditions on routes
• added support for the Symfony VarDumper Component
• added a global Twig variable (an AppVariable instance)
• [BC BREAK] CSRF has been moved to a standalone provider (form.secret is not available anymore)
• added support for the Symfony HttpFoundation Twig bridge extension
• added support for the Symfony Asset Component
• bumped minimum version of Symfony to 2.8
• bumped minimum version of PHP to 5.5.0
• Updated Pimple to 3.0
• Updated session listeners to extends HttpKernel ones
• [BC BREAK] Locale management has been moved to LocaleServiceProvider which must be
registered if you want Silex to manage your locale (must also be registered for the translation service
provider)
• [BC BREAK] Provider interfaces moved to SilexApi namespace, published as separate package via
subtree split
• [BC BREAK] ServiceProviderInterface split in to EventListenerProviderInterface and
BootableProviderInterface
• [BC BREAK] Service Provider support files moved under SilexProvider namespace, allowing
publishing as separate package via sub-tree split
• monolog.exception.logger_filter option added to Monolog service provider
• [BC BREAK] $app['request'] service removed, use $app['request_stack'] instead

1.3.6 (2016-XX-XX)
• n/a

PDF brought to you by Chapter 39: Changelog | 126

generated on April 10, 2019

1.3.5 (2016-01-06)
• fixed typo in SecurityServiceProvider

1.3.4 (2015-09-15)
• fixed some new deprecations
• fixed translation registration for the validators

1.3.3 (2015-09-08)
• added support for Symfony 3.0 and Twig 2.0
• fixed some Form deprecations
• removed deprecated method call in the exception handler
• fixed Swiftmailer spool flushing when spool is not enabled

1.3.2 (2015-08-24)
• no changes

1.3.1 (2015-08-04)
• added missing support for the Expression constraint
• fixed the possibility to override translations for validator error messages
• fixed sub-mounts with same name clash
• fixed session logout handler when a firewall is stateless

1.3.0 (2015-06-05)
• added a $app['user'] to get the current user (security provider)
• added view handlers
• added support for the OPTIONS HTTP method
• added caching for the Translator provider
• deprecated $app['exception_handler']->disable() in favor of unset($app['exception_handler'])
• made Silex compatible with Symfony 2.7 an 2.8 (and keep compatibility with Symfony 2.3, 2.5, and
2.6)
• removed deprecated TwigCoreExtension class (register the new HttpFragmentServiceProvider
instead)
• bumped minimum version of PHP to 5.3.9

1.2.5 (2015-06-04)
• no code changes (last version of the 1.2 branch)

PDF brought to you by Chapter 39: Changelog | 127

generated on April 10, 2019

1.2.4 (2015-04-11)
• fixed the exception message when mounting a collection that doesn't return a ControllerCollection
• fixed Symfony dependencies (Silex 1.2 is not compatible with Symfony 2.7)

1.2.3 (2015-01-20)
• fixed remember me listener
• fixed translation files loading when they do not exist
• allowed global after middlewares to return responses like route specific ones

1.2.2 (2014-09-26)
• fixed Translator locale management
• added support for the $app argument in application middlewares (to make it consistent with route
middlewares)
• added form.types to the Form provider

1.2.1 (2014-07-01)
• added support permissions in the Monolog provider
• fixed Switfmailer spool where the event dispatcher is different from the other ones
• fixed locale when changing it on the translator itself

1.2.0 (2014-03-29)
• Allowed disabling the boot logic of MonologServiceProvider
• Reverted "convert attributes on the request that actually exist"
• [BC BREAK] Routes are now always added in the order of their registration (even for mounted
routes)
• Added run() on Route to be able to define the controller code
• Deprecated TwigCoreExtension (register the new HttpFragmentServiceProvider instead)
• Added HttpFragmentServiceProvider
• Allowed a callback to be a method call on a service (before, after, finish, error, on Application;
convert, before, after on Controller)

1.1.3 (2013-XX-XX)
• Fixed translator locale management

1.1.2 (2013-10-30)
• Added missing "security.hide_user_not_found" support in SecurityServiceProvider
• Fixed event listeners that are registered after the boot via the on() method

PDF brought to you by Chapter 39: Changelog | 128

generated on April 10, 2019

 1.0.2 (2013-10-30)
• Fixed SecurityServiceProvider to use null as a fake controller so that routes can be dumped

1.1.1 (2013-10-11)
• Removed or replaced deprecated Symfony code
• Updated code to take advantages of 2.3 new features
• Only convert attributes on the request that actually exist.

1.1.0 (2013-07-04)
• Support for any Psr\Log\LoggerInterface as opposed to the monolog-bridge one.
• Made dispatcher proxy methods on, before, after and error lazy, so that they will not instantiate the
dispatcher early.
• Dropped support for 2.1 and 2.2 versions of Symfony.

1.0.1 (2013-07-04)
• Fixed RedirectableUrlMatcher::redirect() when Silex is configured to use a logger
• Make DoctrineServiceProvider multi-db support lazy.

1.0.0 (2013-05-03)
• 2013-04-12: Added support for validators as services.
• 2013-04-01: Added support for host matching with symfony 2.2:

Listing 39-1 1 $app->match('/', function() {

2 // app-specific action
3 })->host('example.com');
4
5 $app->match('/', function ($user) {
6 // user-specific action
7 })->host('{user}.example.com');

• 2013-03-08: Added support for form type extensions and guessers as services.
• 2013-03-08: Added support for remember-me via the RememberMeServiceProvider.
• 2013-02-07: Added Application::sendFile() to ease sending BinaryFileResponse.
• 2012-11-05: Filters have been renamed to application middlewares in the documentation.
• 2012-11-05: The before(), after(), error(), and finish() listener priorities now set the
priority of the underlying Symfony event instead of a custom one before.
• 2012-11-05: Removing the default exception handler should now be done via its disable()
method:

Before:

PDF brought to you by Chapter 39: Changelog | 129

generated on April 10, 2019

 unset($app['exception_handler']);

After:

$app['exception_handler']->disable();

• 2012-07-15: removed the monolog.configure service. Use the extend method instead:

Before:

Listing 39-2
$app['monolog.configure'] = $app->protect(function ($monolog) use ($app) {
// do something
});

After:

Listing 39-3 1 $app['monolog'] = $app->share($app->extend('monolog', function($monolog, $app) {

2 // do something
3
4 return $monolog;
5 }));

• 2012-06-17: ControllerCollection now takes a required route instance as a constructor

argument.

Before:

Listing 39-4
$controllers = new ControllerCollection();

After:

Listing 39-5
$controllers = new ControllerCollection(new Route());

// or even better
$controllers = $app['controllers_factory'];

• 2012-06-17: added application traits for PHP 5.4

• 2012-06-16: renamed request.default_locale to locale
• 2012-06-16: Removed the translator.loader service. See documentation for how to use
XLIFF or YAML-based translation files.
• 2012-06-15: removed the twig.configure service. Use the extend method instead:

Before:

Listing 39-6

PDF brought to you by Chapter 39: Changelog | 130

generated on April 10, 2019

 $app['twig.configure'] = $app->protect(function ($twig) use ($app) {
// do something
});

After:

Listing 39-7 1 $app['twig'] = $app->share($app->extend('twig', function($twig, $app) {

2 // do something
3
4 return $twig;
5 }));

• 2012-06-13: Added a route before middleware

• 2012-06-13: Renamed the route middleware to before
• 2012-06-13: Added an extension for the Symfony Security component
• 2012-05-31: Made the BrowserKit, CssSelector, DomCrawler, Finder and Process
components optional dependencies. Projects that depend on them (e.g. through functional tests)
should add those dependencies to their composer.json.
• 2012-05-26: added boot() to ServiceProviderInterface.
• 2012-05-26: Removed SymfonyBridgesServiceProvider. It is now implicit by checking the
existence of the bridge.
• 2012-05-26: Removed the translator.messages parameter (use translator.domains
instead).
• 2012-05-24: Removed the autoloader service (use composer instead). The *.class_path
settings on all the built-in providers have also been removed in favor of Composer.
• 2012-05-21: Changed error() to allow handling specific exceptions.
• 2012-05-20: Added a way to define settings on a controller collection.
• 2012-05-20: The Request instance is not available anymore from the Application after it has been
handled.
• 2012-04-01: Added finish filters.
• 2012-03-20: Added json helper:

Listing 39-8
$data = array('some' => 'data');
$response = $app->json($data);

• 2012-03-11: Added route middlewares.

• 2012-03-02: Switched to use Composer for dependency management.
• 2012-02-27: Updated to Symfony 2.1 session handling.
• 2012-01-02: Introduced support for streaming responses.
• 2011-09-22: ExtensionInterface has been renamed to ServiceProviderInterface. All
built-in extensions have been renamed accordingly (for instance,
Silex\Extension\TwigExtension has been renamed to
Silex\Provider\TwigServiceProvider).
• 2011-09-22: The way reusable applications work has changed. The mount() method now takes
an instance of ControllerCollection instead of an Application one.

PDF brought to you by Chapter 39: Changelog | 131

generated on April 10, 2019

 Before:

Listing 39-9
$app = new Application();
$app->get('/bar', function() { return 'foo'; });

return $app;

After:

Listing 39-10
$app = new ControllerCollection();
$app->get('/bar', function() { return 'foo'; });

return $app;

• 2011-08-08: The controller method configuration is now done on the Controller itself

Before:

Listing 39-11
$app->match('/', function () { echo 'foo'; }, 'GET|POST');

After:

Listing 39-12
$app->match('/', function () { echo 'foo'; })->method('GET|POST');

PDF brought to you by Chapter 39: Changelog | 132

generated on April 10, 2019