Extbase PHP attributes reference
Note
This page is a work in progress. Content will be added as part of the Extbase documentation rewrite for TYPO3 v14.
This page is a quick-reference for all PHP attributes defined and handled by the Extbase framework itself. It covers ORM attributes (used on model properties), validation attributes (used on model properties and action parameters), and controller-level attributes (used on action methods).
It does not cover attributes defined by TYPO3 Core outside of Extbase, or PHP built-in attributes.
On this page
ORM (Object Relational Mapping) attributes (persistence)
ORM (Object-Relational Mapping) is the mechanism that lets you work with PHP objects instead of raw database rows. Therefor Extbase maps database fields to Object Model properties and back. The attributes described below are used to control this process.
The attributes are declared in the
\TYPO3\
namespace and are placed on model properties.
#[Lazy]
- Target
-
Model property
- Fully qualified namespace
-
\TYPO3\CMS\ Extbase\ Attribute\ ORM\ Lazy - Parameters
-
none
By default, relations are resolved and processed by loading all related objects together with the parent,
which can harm performance and trigger N+1 queries, for example in list views.
# tells Extbase to load the related object only when it is actively
accessed — by calling its methods or reading its properties.
When applied to a 1:1 relation, the property type must include
Lazy so Extbase knows to install the proxy. A typed getter
needs an
instanceof check only so PHPStan and your IDE can narrow the
return type to
?Location:
use TYPO3\CMS\Extbase\Attribute\ORM\Lazy;
use TYPO3\CMS\Extbase\Persistence\Generic\LazyLoadingProxy;
class Conference extends AbstractEntity
{
#[Lazy]
protected Location|LazyLoadingProxy|null $location = null;
public function getLocation(): ?Location
{
// the check is only needed to keep phpstan happy. Remove it if not needed.
if ($this->location instanceof LazyLoadingProxy) {
$this->location = $this->location->_loadRealInstance();
}
return $this->location;
}
}
If you do not need a narrowly typed getter, the check is unnecessary — accessing the proxy in any way triggers resolution automatically.
See also
Relations and ObjectStorage — relations and ObjectStorage on the model page.
Persistence relations — full lazy loading reference and the N+1 query trap.
#[Cascade]
- Target
-
Model property
- Fully qualified namespace
-
\TYPO3\CMS\ Extbase\ Attribute\ ORM\ Cascade - Parameters
-
string|null $value = null
Controls what happens to related objects when the parent object is deleted.
Currently only
'remove' is supported:
use TYPO3\CMS\Extbase\Attribute\ORM\Cascade;
use TYPO3\CMS\Extbase\Attribute\ORM\Lazy;
class Conference extends AbstractEntity
{
#[Lazy]
#[Cascade('remove')]
protected ObjectStorage $comments;
}
Without
#, deleting the parent object leaves related
records in the database as orphans. With it, Extbase deletes the related
objects automatically via the repository.
Note
Only
'remove' is supported. Other Doctrine cascade operations
(
'persist',
'merge', etc.) are not implemented in Extbase.
Important
Cascade remove is triggered by Extbase's own persistence layer — it only
fires when you delete an object via a repository method (for example
$repository->remove). Deleting a record through the TYPO3
backend uses the DataHandler, which is unaware of
#. For
cascade behaviour in backend deletions, configure the corresponding TCA
relation with the appropriate delete behaviour.
#[Transient]
- Target
-
Model property
- Fully qualified namespace
-
\TYPO3\CMS\ Extbase\ Attribute\ ORM\ Transient - Parameters
-
none
Excludes a property from persistence entirely. Extbase never reads or writes the corresponding column. Use for computed values or temporary state:
use TYPO3\CMS\Extbase\Attribute\ORM\Transient;
class Conference extends AbstractEntity
{
#[Transient]
protected ?string $displayLabel = null;
}
Validation attributes
These attributes are declared in the
\TYPO3\ namespace
and control validation behaviour on model properties and controller action parameters.
#[Validate]
- Target
-
Model property, action method parameter
- Fully qualified namespace
-
\TYPO3\CMS\ Extbase\ Attribute\ Validate - Repeatable
-
yes — apply multiple
#to one target[Validate] - Parameters
string $validator- The validator class name or short name (for example
'Not,Empty' 'String). Short names resolve against the built-in validators inLength' \TYPO3\.CMS\ Extbase\ Validation\ Validator array $options =[] - Options passed to the validator constructor. The available options depend on the validator.
use TYPO3\CMS\Extbase\Attribute\Validate;
class Conference extends AbstractEntity
{
#[Validate(validator: 'NotEmpty')]
#[Validate(validator: 'StringLength', options: ['minimum' => 3, 'maximum' => 50])]
protected string $title = '';
}
See also
Built-in validators — all built-in validators and their options.
Custom validators — writing a custom validator.
#[IgnoreValidation]
- Target
-
Action method parameter
- Fully qualified namespace
-
\TYPO3\CMS\ Extbase\ Attribute\ Ignore Validation - Parameters
-
none (place directly on the parameter)
Suppresses validation for one action parameter. Useful in multi-step forms where partial state is forwarded between actions:
use TYPO3\CMS\Extbase\Attribute\IgnoreValidation;
class Conference extends AbstractEntity
{
public function previewAction(
#[IgnoreValidation]
Conference $event
): ResponseInterface {
// validation skipped for $event
}
}
Changed in version 14.0
# must be placed on the parameter, not on the
method with an
argument property. The method-level form was
deprecated in TYPO3 v14 (Deprecation #108227).
Controller attributes
These attributes are declared in the
\TYPO3\
namespace and are applied to controller action methods to control access and
rate limiting.
#[Authorize]
- Target
-
Controller action method
- Fully qualified namespace
-
\TYPO3\CMS\ Extbase\ Attribute\ Authorize
New in version 14.0
Introduced in Feature #107826.
Declares access requirements for an action method. Extbase checks the requirements before calling the action and redirects or throws an exception if they are not met.
Warning
# handles action-level access ("is the user logged in?
are they in the right group?") but does not verify record ownership.
Always check that a submitted UID belongs to the current user before
updating or deleting records — Extbase will not do this for you.
#[RateLimit]
- Target
-
Controller action method
- Fully qualified namespace
-
\TYPO3\CMS\ Extbase\ Attribute\ Rate Limit
New in version 14.0
Introduced in Feature #108982.
Limits how often an action may be called within a time window, per visitor. Useful for protecting form submission endpoints against brute-force and spam.