8000 Trusted proxy examples need safer defaults · Issue #7045 · symfony/symfony-docs · GitHub
[go: up one dir, main page]
Skip to content

Trusted proxy examples need safer defaults #7045

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
dzuelke opened this issue Oct 6, 2016 · 6 comments
Closed

Trusted proxy examples need safer defaults #7045

dzuelke opened this issue Oct 6, 2016 · 6 comments
Labels
HttpFoundation
Milestone
3.3

Comments

@dzuelke
Copy link
Contributor
dzuelke commented Oct 6, 2016

http://symfony.com/doc/current/request/load_balancer_reverse_proxy.html and http://symfony.com/doc/current/components/http_foundation/trusting_proxies.html talk about trusting proxies, and http://symfony.com/doc/current/request/load_balancer_reverse_proxy.html#but-what-if-the-ip-of-my-reverse-proxy-changes-constantly in particular mentions AWS as an example.

AWS ELBs do not set a Forwarded header, making it necessary to follow the instructions at http://symfony.com/doc/current/request/load_balancer_reverse_proxy.html#my-reverse-proxy-sends-x-forwarded-for-but-does-not-filter-the-forwarded-header, but they also do not set an X-Forwarded-Host (only …-For, …-Port and …-Proto), which means, that for a very popular use case (running on AWS, or products that build on it, e.g. Heroku), applications would be vulnerable to spoofing of those headers.

My suggestion would be to

  1. explicitly mention for the AWS case that both Forwarded and X-Forwarded-Host must be distrusted, or better yet
  2. explicitly list known safe combinations for popular IaaS/PaaS systems and then
  3. instruct users to carefully double-check what headers their platform in question supports, and distrust any that it does not.
@dzuelke dzuelke mentioned this issue Oct 6, 2016
Closed
@xabbuh xabbuh added the Cache label Oct 11, 2016
@dzuelke
Copy link
Contributor Author
dzuelke commented Oct 13, 2016

"Cache" is the wrong label @xabbuh :)

@xabbuh
Copy link
Member
xabbuh commented Oct 21, 2016

Oops, thanks for the heads up @dzuelke :)

@dzuelke dzuelke mentioned this issue Mar 30, 2017
Merged
@dzuelke dzuelke changed the title Trusted proxy examples need safer examples Trusted proxy examples need safer defaults Mar 31, 2017
@weaverryan
Copy link
Member

See symfony/symfony#21830 and symfony/symfony#22238

I haven't digested the changes yet, but I'm updating this milestone to 3.3 because that's where the changes were made and I want to make sure we've got it right for that release :)

@weaverryan weaverryan added this to the 3.3 milestone Apr 4, 2017
@nicolas-grekas nicolas-grekas mentioned this issue May 25, 2017
Merged
@nicolas-grekas
Copy link
Member

See symfony/symfony#22904

@nicolas-grekas nicolas-grekas mentioned this issue May 25, 2017
Closed
fabpot added a commit to symfony/symfony that referenced this issue May 25, 2017
@fabpot
feature #22904 [HttpFoundation] Add Request::HEADER_X_FORWARDED_AWS_E…
fa93ff1 
…LB const (nicolas-grekas)

This PR was merged into the 3.3 branch.

Discussion
----------

[HttpFoundation] Add Request::HEADER_X_FORWARDED_AWS_ELB const

| Q             | A
| ------------- | ---
| Branch?       | 3.3
| Bug fix?      | yes (a missing part of a 3.3 feat.)
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

See symfony/symfony-docs#7045

Commits
-------

9ba12b0 [HttpFoundation] Add Request::HEADER_X_FORWARDED_AWS_ELB const
@HeahDude
Copy link
Contributor

Can we close here?

@javiereguiluz
Copy link
Member

Closing as probably fixed by the mentioned pull requests. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
HttpFoundation
Projects
None yet
Milestone
3.3
Development

No branches or pull requests
6 participants
@dzuelke @javiereguiluz @weaverryan @nicolas-grekas @xabbuh @HeahDude
0