Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[11.x] Fix Middleware::trustHosts(subdomains: true) #50877

Merged
merged 4 commits into from
Apr 1, 2024
Merged

[11.x] Fix Middleware::trustHosts(subdomains: true) #50877

merged 4 commits into from
Apr 1, 2024

Conversation

axlon
Copy link
Contributor

@axlon axlon commented Apr 1, 2024

Fixes #50845

This PR fixes 2 problems with Middleware::trustHosts():

8e0eb64:

When Middleware::trustHosts() is called with hosts (e.g. $middleware->trustHosts(['127.0.0.1'])) it immediately tries to configure the TrustHosts middleware. The TrustHosts middleware itself is reliant on the application's config, so it cannot be configured this early in the bootstrapping process. This is fixed by only setting what we need to do, but not doing it until a request happens.

a6171fd:

Its not uncommon to rely on certain container services when deciding on what hosts to trust, but because the Middleware::trustHosts() method only accepts an already resolved array and happens so early in the bootstrapping process we cannot use those services yet.

This is fixed by allowing developers to pass a callback that "lazily" resolves the hosts. This enables the following:

$middleware->trustHosts(fn () => config('app.allowed_hosts'));

@taylorotwell taylorotwell merged commit 2617749 into laravel:11.x Apr 1, 2024
28 checks passed
@axlon axlon deleted the fix-50845 branch April 2, 2024 06:52
amaralis added a commit to amaralis/laravel-docs that referenced this pull request Aug 15, 2024
taylorotwell added a commit to laravel/docs that referenced this pull request Aug 15, 2024
* Add trustHosts() documentation when hosts are fetched from configuration file

Document the fix from laravel/framework#50877, triggered by issue laravel/framework#50845

* Update requests.md

---------

Co-authored-by: Taylor Otwell <taylor@laravel.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[11.x] Calling Middleware::trustHosts() with arguments breaks entire application
2 participants