Symfony is often described as a PHP framework, but at its core are around fifty independent libraries. Each solves a specific problem, while the framework brings them together through shared configuration and conventions.
Symfony components can be installed individually using Composer and used outside applications built with the full framework. In this guide, we explain what the most important components do, from HTTP handling and application architecture to data processing, asynchronous operations, security and developer tools.
Each Symfony component is a separate package, so you can add only the elements your project needs. You don't have to use the entire framework to take advantage of a specific component in a PHP application
Symfony components have minimal dependencies. Most depend primarily on PHP and the relevant symfony/*-contracts packages. Contracts provide interfaces without their implementations, allowing application code to depend on abstractions rather than directly on a particular Symfony implementation.
FrameworkBundle acts as the layer that brings these components together within the framework. It provides configuration and registers services in the container, while the components themselves remain independent libraries.
Symfony components can be grouped according to the problems they solve:
HTTP: HttpFoundation, HttpKernel, Routing, HttpClient.
Application architecture: DependencyInjection, EventDispatcher, Config, OptionsResolver, Runtime, Dotenv.
Data processing: Serializer, PropertyAccess, PropertyInfo, TypeInfo, Validator, Form, Yaml, JsonPath.
Asynchronous processing: Messenger, Mailer, Mime, Notifier, Scheduler.
Security: Security, RateLimiter, Lock, Semaphore, UID.
Developer tools: Console, Process, Filesystem, Finder, Cache, Translation, Workflow.
Symfony's HTTP components form the layer responsible for an application's communication over HTTP. Symfony treats HTTP as more than an implementation detail. It is a programming model that provides the foundation for how other parts of the application work.
HttpFoundation turns PHP's HTTP-related global arrays into objects representing requests and responses. It also handles sessions, cookies, content negotiation, Server-Sent Events (SSE), uploaded files and streamed responses.
Streamed responses make it possible to work with large amounts of data that may not fit into memory. The component also supports file responses with resumable downloads.
HttpKernel defines the framework's fundamental operation: receive a request and return a response. Everything that happens between these two points is organized around a defined set of events. Developers can hook into these events using EventDispatcher.
Routing maps URLs to the code responsible for handling them. It also works in the opposite direction, generating URLs based on route names. As a result, changing the URL associated with a route can be reflected in links generated by the application without manually updating each one.
Routing also supports configuration based on factors such as the domain or language.
HttpClient handles outgoing HTTP requests.
Symfony needed an HTTP client partly to support components such as Mailer and Notifier. Introducing Guzzle as a framework dependency would have meant imposing a specific library and its dependency tree, which would have conflicted with Symfony's modular architecture.
HttpClient and Guzzle also take different approaches to asynchronous operations. Guzzle uses a promise-based model, while HttpClient streams responses. A request starts immediately, and execution only blocks when the code attempts to read the response data.
Code that depends on PSR-18 can work with Symfony HttpClient, Guzzle or another implementation of the standard.
Symfony's application architecture components define how different parts of an application are connected and how they work together. They cover object creation and dependency management, event-driven communication, configuration and the way an application is started.
DependencyInjection provides the service container responsible for assembling the application. It creates objects and supplies their required dependencies, eliminating the need to manually construct the entire object graph.
The container can discover services based on the types declared in constructors and handle autoconfiguration. Manual configuration is mainly needed for specific cases. This mechanism also makes it easier to replace one implementation with another.
EventDispatcher enables communication between application components through events. It implements the Observer and Mediator design patterns. It allows developers to extend application behavior without modifying existing code, as different parts of the application can respond to events without being directly coupled to one another.
This makes it possible to build extensible solutions without changing their source code. Sylius is one of the projects that uses this mechanism.
Both Config and OptionsResolver deal with configuration, but they operate at different levels.
Config loads configuration from sources such as YAML, XML or PHP, validates it against a defined schema and merges values from multiple sources. Symfony uses this mechanism to build the configuration system for its bundles.
OptionsResolver organizes and validates arrays of options passed to application code. It allows developers to define required fields, default values and accepted types without manually checking every array key.
Runtime separates application code from the way the application is executed. The same code can run under traditional PHP-FPM or as a long-running process, for example with FrankenPHP. Runtime translates the input format of a particular execution environment into objects that Symfony can work with.
Dotenv loads environment variables from .env* files, allowing configuration to remain separate from application code in line with the 12-Factor App methodology. Values can vary between environments and be overridden locally, for example using .env.local.
Symfony's data processing components handle information flowing through an application. This includes data received from forms and APIs, validating that data and determining how it is represented when sent to external systems.
Serializer transforms data structures from one format into another. It also provides serialization groups, allowing the same object to have different representations depending on who receives the data.
For example, an order can expose different sets of information to a customer, an administrator and an accounting system without requiring a separate mapping for each case.
In this case, one illustration from the official Symfony documentation is worth a thousand words.
These are low-level components used by other parts of Symfony, including Form, Serializer and Validator.
PropertyAccess reads and writes object properties. It automatically detects getters, setters and methods such as addItem.
PropertyInfo extracts type information from sources including PHP declarations, annotations and Doctrine mappings.
TypeInfo provides a newer, consistent representation of PHP's type system. It was introduced to address problems and limitations in PropertyInfo and is gradually replacing earlier solutions.
Validator checks whether data meets a defined set of rules. It supports nested objects, validation groups and conditional constraints.
The mechanism is built around three elements:
Constraints, which represent validation rules.
Metadata, which defines how those rules are assigned to fields.
Validator Service, which performs validation and returns a list of errors.
Validator also works with Serializer.
Form handles the entire lifecycle of a form, from building and rendering it to receiving input, validating data and mapping values back to an object.
It is one of Symfony's most extensive components and allows forms to be adapted flexibly to an application's requirements.
Forms are defined as separate classes, making it possible to reuse them in different parts of an application.
The component also supports CSRF protection and additional fields that are not defined in the FormType.
To provide these capabilities, Form uses other Symfony components, including Validator, OptionsResolver, PropertyAccess and TypeInfo.
Yaml parses and generates YAML. It converts YAML into PHP arrays and vice versa.
It also supports Symfony-specific features such as %env(DATABASE_URL)% and PHP constants expressed using !php/const.
JsonPath retrieves specific data from deeply nested JSON or YAML structures using text-based queries. It works in a similar way to XPath for XML.
Asynchronous processing in Symfony allows certain operations to run outside the main HTTP request-response cycle. It covers background tasks, message queues, message delivery and scheduled operations.
Among other benefits, this can reduce request processing time, deliberately delay an operation or ensure that a temporary outage in an external system results in a delay rather than data loss.
Messenger handles asynchronous task processing and message handling in queue-based architectures. It allows resource-intensive or time-consuming operations, such as generating PDFs, to be moved outside the HTTP request lifecycle and executed in the background.
Messenger supports multiple transport systems, including RabbitMQ, Redis, Amazon SQS and database tables. It also provides retries with increasing delays (exponential backoff) and delayed message delivery.
Mime creates email message objects and handles elements such as headers, character encoding and attachments.
Mailer sends the prepared messages via SMTP or provider APIs, including services such as Mailgun, SendGrid and Amazon SES.
Mailer also integrates with Messenger, allowing email delivery to be handled through a queue.
Notifier allows applications to send notifications through different channels using a single interface.
Instead of building separate mechanisms for email, SMS or Slack notifications, an application can use one service and select the appropriate channel based on the importance of an event and the recipient's preferences.
Scheduler handles recurring tasks and allows schedules to be defined in PHP code rather than maintained entirely through the operating system's Cron configuration. This means schedules can be version-controlled, tested and maintained consistently across different environments.
With this approach, a Linux system only needs a single main Cron job to start Messenger workers, while the execution times and frequencies of individual tasks are configured in the application code.
Symfony's security-related components address several distinct responsibilities: identifying users, determining what they are allowed to do, controlling how frequently operations can be performed and managing concurrent execution.
Symfony provides separate components for each of these tasks.
Security handles authentication and authorization. Authentication establishes who a user is, while authorization determines what that user is allowed to do. The component provides mechanisms for both, including approaches based on forms, JWT and OAuth.
RateLimiter limits the number of requests a user or a specific IP address can make within a defined period. It can be used, among other things, to protect applications against bots and brute-force attacks.
Lock ensures that only one process can execute a particular operation at a time, helping prevent race conditions.
Semaphore allows developers to define a higher limit on the number of processes that can execute an operation concurrently. This can be useful when communicating with an external API that imposes connection limits or when processing background tasks through Messenger.
UID generates unique identifiers in UUID and ULID formats. These identifiers can be created by the application before data is saved to the database. They also allow public URLs to avoid revealing the number of records stored in the system.
Both formats are sortable and help prevent fragmentation of B-tree indexes. Starting with Symfony 7.4, UUID v7 is the default version used when generating UUIDs.
This group of Symfony components provides tools for handling tasks beyond the basic request-response cycle. They allow developers to execute commands, work with files, run external programs and store the results of expensive operations for later reuse.
Console makes it possible to build command-line interfaces in PHP. Developers can create custom commands to automate tasks such as recurring data imports, generating reports or product feeds, and cancelling unpaid orders.
The component also supports progress bars for long-running operations and interactive questions presented to users while a script is running.
Process allows PHP applications to launch and control external programs and system commands. It supports execution timeouts, real-time output reading and asynchronous execution. The component provides an object-oriented interface that replaces native PHP functions such as exec().
For example, it can be used to run an external PDF generation tool or a Python script from PHP code while retaining control over errors.
Finder searches for files and directories based on specified criteria. Filesystem performs operations on the file system, including creating directories, copying and deleting data, and creating symbolic links.
Filesystem provides consistent behavior across operating systems, allowing the same code to run on a Linux server and a local Windows machine.
Cache stores the results of expensive operations so they can be reused. These may include API responses, database data, computationally intensive calculations or file operations. Symfony Cache implements PSR-6 and also provides its own interface based on a "get and compute" approach.
Translation supports the development of multilingual applications. Among other features, it handles pluralization according to the ICU standard and can integrate with external localization platforms such as Lokalise.
Workflow manages object lifecycles by modeling business processes as state machines. The logic is defined using states (places) and transitions.
The component ensures that an object cannot move into a state through an invalid transition. It can also automatically dispatch events when state changes occur.
Workflow also allows business processes to be visualized as flowcharts. Sylius makes extensive use of this component, including for order lifecycles and returns.
Symfony components are independent PHP libraries designed to solve specific application development problems. They can be installed individually using Composer and used outside applications built with the full Symfony framework.
Yes. Each component is a separate package, so you can install only the ones your project needs. FrameworkBundle brings components together within the framework, but the components themselves remain independent libraries.
Symfony components can be divided into several areas: HTTP handling, application architecture, data processing, asynchronous operations, security and developer tools.
Some of the most important include HttpFoundation, HttpKernel, Routing, DependencyInjection, Serializer, Form, Messenger, Security and Console.
Different aspects of HTTP communication are handled by HttpFoundation, HttpKernel, Routing and HttpClient.
HttpFoundation represents requests and responses as objects. HttpKernel organizes the request-handling process, Routing maps URLs to application code, and HttpClient handles outgoing HTTP requests.
Messenger handles messages and asynchronous task processing in queue-based architectures. It supports different transport systems, retries for failed operations and delayed message delivery.
Commerce Weavers is taking responsibility for building the Open Mercato financial module. The first iteration covers the...
Read more →
Choosing a framework may seem like a purely technical decision. In practice, however, it affects much more than how deve...
Read more →
AI is becoming an increasingly important part of the day-to-day work of e-commerce development teams. It helps generate ...
Read more →
