Download the PHP package konradmichalik/typo3-routing without Composer

This extension lets you register frontend endpoints via PHP attributes on controller methods — the attribute-based counterpart to the backend-only Configuration/Backend/AjaxRoutes.php. It is response-format agnostic: return JSON, HTML, XML, or a download.

[!NOTE] The goal is a familiar, Symfony-Routing-like developer experience: declare a frontend endpoint with a single #[Route] attribute instead of wiring a custom middleware and duplicating the path across PHP and JavaScript.

✨ Features

• Attribute routing — declare an endpoint with #[Route] directly on a controller method
• Route groups — a class-level #[Route] prefixes every method route, e.g. for API versioning
• Typed arguments — methods receive type-cast path/query/body values, no manual request reading
• Zero-config discovery — routes are collected at container compile time, no extra cache
• URL generation — a Fluid ViewHelper so the path lives once, not duplicated as a PHP constant and a JS string
• Opt-in caching — cache responses with #[Cache], with tag-based invalidation
• Opt-in rate limiting — throttle requests per client IP with #[RateLimit]
• Opt-in authentication & CSRF — protect routes with #[Authenticate] (bearer token / FE / BE user) and #[RequireRequestToken]
• CORS — opt-in cross-origin support with automatic preflight handling, configured globally
• Debug command — list every registered route as a table or JSON, including an --unprotected audit
• OpenAPI export — generate an OpenAPI 3.1 document from your routes with routing:openapi

🔥 Installation

Requirements

• TYPO3 >= 13.4
• PHP 8.2+

Composer

TER

Download the zip file from TYPO3 extension repository (TER).

🚀 Quick start

Implement RouteControllerInterface, register the controller as a service, and annotate a public method with #[Route]:

That's it — GET /api/course-search/count now returns your JSON.

Everything else is opt-in on top of that. A route can take typed arguments, validate input, cache its response, and throttle clients — all declared with attributes, the controller stays plain:

Protecting a route is just as declarative — require a logged-in frontend user (or a bearer token / BE user, OR-combined):

See Usage for the full #[Route] reference and typed arguments.

📚 Documentation

🧑‍💻 Contributing

Please have a look at CONTRIBUTING.md.

⭐ License

This project is licensed under GNU General Public License 2.0 (or later).