{"record":{"id":"eda386649aea3519","repo":"symfony/http-kernel","slug":"request-payload-contains-invalid-s-property","errorCode":null,"errorMessage":"Request payload contains invalid \"%s\" property.","messagePattern":"Request payload contains invalid \"(.+?)\" property\\.","errorType":"http","errorClass":"BadRequestHttpException","httpStatus":400,"severity":"error","filePath":"Controller/ArgumentResolver/RequestPayloadValueResolver.php","lineNumber":290,"sourceCode":"\n        if (\\is_array($data)) {\n            $data = $this->mergeParamsAndFiles($data, $request->files->all());\n\n            return $this->serializer->denormalize($data, $type, self::hasNonStringScalar($data) ? $format : 'csv', $attribute->serializationContext + self::CONTEXT_DENORMALIZE + ('form' === $format ? ['filter_bool' => true] : []));\n        }\n\n        if ('form' === $format) {\n            throw new BadRequestHttpException('Request payload contains invalid \"form\" data.');\n        }\n\n        try {\n            return $this->serializer->deserialize($data, $type, $format, self::CONTEXT_DESERIALIZE + $attribute->serializationContext);\n        } catch (UnsupportedFormatException $e) {\n            throw new UnsupportedMediaTypeHttpException(\\sprintf('Unsupported format: \"%s\".', $format), $e);\n        } catch (NotEncodableValueException $e) {\n            throw new BadRequestHttpException(\\sprintf('Request payload contains invalid \"%s\" data.', $format), $e);\n        } catch (UnexpectedPropertyException $e) {\n            throw new BadRequestHttpException(\\sprintf('Request payload contains invalid \"%s\" property.', $e->property), $e);\n        }\n    }\n\n    private function mapUploadedFile(Request $request, ArgumentMetadata $argument, MapUploadedFile $attribute): UploadedFile|array|null\n    {\n        if ($files = $request->files->get($attribute->name ?? $argument->getName())) {\n            return !\\is_array($files) && $argument->isVariadic() ? [$files] : $files;\n        }\n\n        if ($argument->isNullable() || $argument->hasDefaultValue()) {\n            return null;\n        }\n\n        return 'array' === $argument->getType() ? [] : null;\n    }\n\n    private function mergeParamsAndFiles(array $params, array $files): array\n    {","sourceCodeStart":272,"sourceCodeEnd":308,"githubUrl":"https://github.com/symfony/http-kernel/blob/aa3a39d7286a62cdfea98f0e69c651a3da6e36cf/Controller/ArgumentResolver/RequestPayloadValueResolver.php#L272-L308","documentation":"When deserializing a request payload mapped via #[MapRequestPayload], the serializer encountered an UnexpectedPropertyException - the JSON/body contains a property that does not exist on the target DTO and strict property handling is active. Symfony converts it to a 400 with the offending property name. This guards typed DTOs against unexpected/misspelled fields.","triggerScenarios":"Client sends JSON with a key that has no matching property on the mapped DTO class while the serializer context enables strict/ignore-false behavior (e.g. denormalize with 'allow_extra_attributes' => false or default strict behavior in recent serializer versions).","commonSituations":"API clients sending extra metadata fields; renamed DTO properties after an upgrade while clients still send old field names; typos in field names; Symfony 7.x stricter serializer defaults.","solutions":["Remove the unknown property from the client payload or fix its spelling to match the DTO.","Add the missing property to the DTO (or a #[SerializedName]) if the field is legitimate.","Set serializationContext on the attribute: ['allow_extra_attributes' => true] to ignore extra fields.","Version your API so old clients keep sending payloads compatible with the deployed DTO."],"exampleFix":"// before\n#[MapRequestPayload] UserDto $dto\n// after: tolerate extra fields\n#[MapRequestPayload(serializationContext: ['allow_extra_attributes' => true])] UserDto $dto","handlingStrategy":"type-guard","validationCode":"const allowed = new Set(['name','email']);\nconst extra = Object.keys(payload).filter(k => !allowed.has(k));\nif (extra.length) throw new Error('Unknown fields: ' + extra.join(','));","typeGuard":null,"tryCatchPattern":"try {\n    $result = $api->submit($payload);\n} catch (BadRequestHttpException $e) {\n    // message names the offending property; strip it and retry\n    $logger->warning('Unexpected property sent', ['msg' => $e->getMessage()]);\n}","preventionTips":["Keep client payloads in sync with DTO definitions; generate clients from OpenAPI/schema.","Fix field-name typos immediately after any DTO rename.","Use serializationContext allow_extra_attributes when forward compatibility matters."],"tags":["symfony","http-kernel","serializer","bad-request","dto"],"backgroundTag":"schema-validation-failed","analyzedSha":"aa3a39d7286a62cdfea98f0e69c651a3da6e36cf","analyzedAt":"2026-09-13T18:03:36.509Z","contentChangedAt":"2026-09-13T18:03:36.509Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}