Framework Core

Authentication answers who are you: it verifies a credential and establishes the current user. Authorization answers may you do this: it checks that the already-identified user is permitted to perform this action on this resource. Authentication comes first — being logged in does not make you allowed.

Middleware is a layer that wraps the request-to-response cycle. Each one receives the request, may act on it, calls $next($request) to pass it further down the chain, and can then inspect or alter the response on the way back. It sits between the kernel and the controller — auth, CORS and throttling live there.

The router maps the URL to a controller action. The controller coordinates: it pulls data through models — Eloquent models or Doctrine entities — and hands the result to a view (Blade or Twig) to render. The controller should stay thin; business rules belong in a model or a service, not in the action.

One declaration generates a fixed set of named routes against one controller: GET /posts calls index, POST /posts calls store, GET /posts/{id} calls show, PUT or PATCH /posts/{id} calls update, and DELETE /posts/{id} calls destroy. The verb plus the path selects the action.

It resolves and builds it for you. The container reads the constructor's type hints, recursively instantiates each dependency, and injects them, so you never new a collaborator by hand. Bindings tell it which concrete class to supply for an interface, and a singleton binding reuses one instance.

A session keeps state on the server: the cookie carries only an id and the server looks the session up, so revoking access is instant, but it needs shared storage and CSRF protection. A JWT is self-contained and stateless — the server just verifies a signature, which scales, but you cannot revoke it before it expires.

Blade compiles down to plain PHP, so a template may call any PHP it likes — convenient and easy to abuse. Twig has its own sandboxed syntax with no raw PHP at all and escapes output by default. Blade escapes with {{ }} but {!! !!} opts out. Twig enforces the discipline; Blade trusts you.

You annotate the action: #[Route('/posts/{id}', name: 'post_show', methods: ['GET'])]. Symfony reads those attributes by reflection while warming the cache and compiles them into a route table, so matching at runtime is a lookup rather than a scan. Placeholders like {id} arrive as action arguments.

You declare the rules on the properties — #[Assert\NotBlank], #[Assert\Email] — and call $validator->validate($dto). It walks that metadata by reflection, runs each constraint, and returns a ConstraintViolationList. The object stays a plain DTO; the rules travel with it rather than with the controller.

The container resolves by type. With two classes behind PaymentGatewayInterface it cannot choose, so it throws at compile time — loudly, never silently picking one. The fix is an explicit binding: a Symfony alias or Laravel's contextual binding.

The action dispatches a domain event such as OrderPlaced and knows nothing about who reacts. Each side effect is its own listener, testable alone, and can implement ShouldQueue to run outside the request. The cost: control flow becomes implicit.

Type-hint a FormRequest and the container resolves it: before the body runs it calls authorize(), then rules(). Failure throws ValidationException — 422 for an API, a redirect back for a web form. The body sees only $request->validated().

Not a static class: Cache::get() hits __callStatic, which pulls the real object from the container and forwards the call. The criticism is that it hides dependencies: the constructor no longer declares what the class needs, so tests static-mock.

A policy is bound to one model; its methods are abilities of signature (User $user, Post $post): bool. Call $this->authorize('update', $post) or the can: middleware; denial throws AuthorizationException → 403. The instance proves ownership.

A provider is the bootstrap unit. register() may only bind into the container — never resolve a service there, as other providers may not have registered yet. boot() runs after all have, so it adds routes and listeners. Deferred ones load lazily.

Middleware is a decorator pipeline: each layer gets the request plus $next, runs before and after it, and short-circuits by not calling $next, so order is semantic. A kernel listener instead subscribes to lifecycle events and sets a response.

Sanctum is lightweight: opaque tokens in the database, carrying abilities checked at authorization time, plus a cookie mode for a same-domain SPA. Passport is a full OAuth2 server. Your own SPA or app takes Sanctum; third-party clients take Passport.

It resolves each constructor parameter by its type-hint using reflection, at container compile time — autowire: true in services.yaml. That yields a compiled PHP container class, not a per-request lookup, so wiring errors appear at cache warm-up.

A policy is bound to one model class: its methods are abilities and exactly one answers. A voter is not — it declares supports($attribute, $subject), and the access decision manager polls every voter, combining their votes under a strategy.

Render errors in ONE place — the exception handler — mapping each domain exception to a status code. Emit one envelope (application/problem+json): validation and auth differ in fields, not shape. The status carries the outcome, not a 200. Stack traces go to the log.

URI versioning is the pragmatic default: visible, cacheable, routable. Media-type versioning is purer but hostile to clients and caches. Version the contract, not the codebase: one business layer, only the serializer varies. Per-client tokens show who still calls v1.

Announce in band, measure, then remove. Emit Deprecation and Sunset response headers so the deadline travels with every response. Middleware logs the calling client id on each hit, giving a per-client usage curve. Before the cut, run a short brownout of 410s.

A synchronous read on a fixed contract is REST. The 50k no-reply notifications go on a queue: the producer must not care the consumer is down; only a broker gives durability and retries. GraphQL pays only for many shapes of one graph, costing caching and field auth.