Skip to content

Conversation

axlon
Copy link
Contributor

@axlon axlon commented Apr 1, 2024

Fixes #50845

This PR fixes 2 problems with Middleware::trustHosts():

8e0eb64:

When Middleware::trustHosts() is called with hosts (e.g. $middleware->trustHosts(['127.0.0.1'])) it immediately tries to configure the TrustHosts middleware. The TrustHosts middleware itself is reliant on the application's config, so it cannot be configured this early in the bootstrapping process. This is fixed by only setting what we need to do, but not doing it until a request happens.

a6171fd:

Its not uncommon to rely on certain container services when deciding on what hosts to trust, but because the Middleware::trustHosts() method only accepts an already resolved array and happens so early in the bootstrapping process we cannot use those services yet.

This is fixed by allowing developers to pass a callback that "lazily" resolves the hosts. This enables the following:

$middleware->trustHosts(fn () => config('app.allowed_hosts'));

@taylorotwell taylorotwell merged commit 2617749 into laravel:11.x Apr 1, 2024
@axlon axlon deleted the fix-50845 branch April 2, 2024 06:52
amaralis added a commit to amaralis/laravel-docs that referenced this pull request Aug 15, 2024
taylorotwell added a commit to laravel/docs that referenced this pull request Aug 15, 2024
* Add trustHosts() documentation when hosts are fetched from configuration file

Document the fix from laravel/framework#50877, triggered by issue laravel/framework#50845

* Update requests.md

---------

Co-authored-by: Taylor Otwell <taylor@laravel.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[11.x] Calling Middleware::trustHosts() with arguments breaks entire application

2 participants