Symfony 6.4

Apply the PHP 8.4 baseline first. These rules cover the Symfony 6.4 LTS line, which requires PHP 8.1 or later. Configure its security controls explicitly; several protections enabled by default in Symfony 7.0 are opt-in in 6.4. Read each release range below against the installed version of the component that owns the API, such as symfony/yaml or symfony/http-foundation, because Symfony does not tag every component in every 6.4 patch release.

Request binding and validation

• Bind untrusted bodies with #[MapRequestPayload] and query data with #[MapQueryString] into dedicated DTOs, never onto Doctrine entities; use #[MapQueryParameter] for individual scalar, array, or backed-enum arguments.
• Set #[MapRequestPayload(acceptFormat: 'json')] on JSON endpoints and give other endpoints an explicit format allowlist. Do not let a caller select Serializer YAML merely because symfony/yaml is installed; enforce body-byte and collection-size limits before mapping or collecting denormalization errors.
• Remember the mismatched defaults in 6.4: #[MapRequestPayload] answers a validation failure with 422 while #[MapQueryString] answers with 404; set validationFailedStatusCode so a rejected query string is not reported as a missing resource.
• Set framework.http_method_override to false; leaving it unset in 6.4 still resolves to true, so a plain POST carrying _method=DELETE reaches destructive routes and controllers. Reject unwanted X-HTTP-Method-Override headers separately, since this setting only disables the parameter override.
• Declare form fields