First thing I do on a Laravel site is add a middleware to all my API routes that allows only blessed content types (usually application/json and application/x-n

First thing I do on a Laravel site is add a middleware to all my API routes that allows only blessed content types (usually application/json and application/x-ndjson). With Symfony it's a couple lines of yaml.