10000 Documented how to configure Symfony correctly with regards to the Forwarded header by magnusnordlander · Pull Request #6526 · symfony/symfony-docs · GitHub
[go: up one dir, main page]

Skip to content

Documented how to configure Symfony correctly with regards to the Forwarded header #6526

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from
Closed
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Updates according to review comments.
  • Loading branch information
magnusnordlander committed May 5, 2016
commit f2903524b51edf6516ff7ce0a746129881ad8a87
4 changes: 2 additions & 2 deletions components/http_foundation/trusting_proxies.rst
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ If you find yourself behind some sort of proxy - like a load balancer - then
certain header information may be sent to you using special ``X-Forwarded-*``
headers or the ``Forwarded`` header. For example, the ``Host`` HTTP header is
usually used to return the requested host. But when you're behind a proxy,
the true host may be stored in a ``X-Forwarded-Host`` header.
the actual host may be stored in a ``X-Forwarded-Host`` header.

Since HTTP headers can be spoofed, Symfony does *not* trust these proxy
headers by default. If you are behind a proxy, you should manually whitelist
Expand Down Expand Up @@ -65,4 +65,4 @@ listed above are trusted. If you need to trust some of these headers but
not others, you can do that as well::

// disables trusting the ``Forwarded`` header
Request::setTrustedHeaderName(Request::HEADER_FORWARDED, '');
Request::setTrustedHeaderName(Request::HEADER_FORWARDED, null);
4 changes: 2 additions & 2 deletions cookbook/cache/varnish.rst
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ in the Symfony configuration so that Varnish is seen as a trusted proxy and the
Varnish, in its default configuration, sends the ``X-Forwarded-For`` header but
does not filter out the ``Forwarded`` header. If you have access to the Varnish
configuration file, you can configure Varnish to remove the ``Forwarded``
header::
header:

.. code-block:: varnish4

Expand All @@ -37,7 +37,7 @@ header::

If you do not have access to your Varnish configuration, you can instead
configure Symfony to distrust the ``Forwarded`` header as detailed in
:doc:`/cookbook/request/load_balancer_reverse_proxy`.
:ref:`the cookbook <cookbook-request-untrust-header>`.

.. _varnish-x-forwarded-headers:

Expand Down
8 changes: 5 additions & 3 deletions cookbook/request/load_balancer_reverse_proxy.rst
Original file line number Diff line number Diff line change
Expand Up @@ -98,12 +98,14 @@ That's it! It's critical that you prevent traffic from all non-trusted sources.
If you allow outside traffic, they could "spoof" their true IP address and
other information.

My Reverse Proxy sends X-Forwarded-For but does not filter the Forwarded header
.. _cookbook-request-untrust-header:

My Reverse Proxy Sends X-Forwarded-For but does not Filter the Forwarded Header
-------------------------------------------------------------------------------

Many popular proxy implementations do not yet support the Forwarded header and
does not filter it by default configuration. Ideally, you would configure this
in your proxy, but if this is not possible, you can tell Symfony to distrust
do not filter it by default. Ideally, you would configure this
in your proxy. If this is not possible, you can tell Symfony to distrust
the Forwarded header, while still trusting your proxy's X-Forwarded-For header.

This is done inside of your front controller::
Expand Down
0