Skip to content

Commit

Permalink
[#6526] some minor tweaks
Browse files Browse the repository at this point in the history
  • Loading branch information
xabbuh committed May 9, 2016
1 parent 691ead1 commit 574afd5
Show file tree
Hide file tree
Showing 2 changed files with 9 additions and 8 deletions.
2 changes: 1 addition & 1 deletion components/http_foundation/trusting_proxies.rst
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ If you find yourself behind some sort of proxy - like a load balancer - then
certain header information may be sent to you using special ``X-Forwarded-*``
headers or the ``Forwarded`` header. For example, the ``Host`` HTTP header is
usually used to return the requested host. But when you're behind a proxy,
the actual host may be stored in a ``X-Forwarded-Host`` header.
the actual host may be stored in an ``X-Forwarded-Host`` header.

Since HTTP headers can be spoofed, Symfony does *not* trust these proxy
headers by default. If you are behind a proxy, you should manually whitelist
Expand Down
15 changes: 8 additions & 7 deletions cookbook/request/load_balancer_reverse_proxy.rst
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,8 @@ the CIDR notation ``10.0.0.0/8``. For more details, see the
:ref:`framework.trusted_proxies <reference-framework-trusted-proxies>` option.

You are also saying that you trust that the proxy does not send conflicting
headers, e.g. sending both X-Forwarded-For and Forwarded in the same request.
headers, e.g. sending both ``X-Forwarded-For`` and ``Forwarded`` in the same
request.

That's it! Symfony will now look for the correct headers to get information
like the client's IP address, host, port and whether the request is
Expand Down Expand Up @@ -100,13 +101,13 @@ other information.

.. _cookbook-request-untrust-header:

My Reverse Proxy Sends X-Forwarded-For but does not Filter the Forwarded Header
My Reverse Proxy Sends X-Forwarded-For but Does not Filter the Forwarded Header
-------------------------------------------------------------------------------

Many popular proxy implementations do not yet support the Forwarded header and
do not filter it by default. Ideally, you would configure this
in your proxy. If this is not possible, you can tell Symfony to distrust
the Forwarded header, while still trusting your proxy's X-Forwarded-For header.
Many popular proxy implementations do not yet support the ``Forwarded`` header
and do not filter it by default. Ideally, you would configure this in your
proxy. If this is not possible, you can tell Symfony to distrust the ``Forwarded``
header, while still trusting your proxy's ``X-Forwarded-For`` header.

This is done inside of your front controller::

Expand All @@ -119,7 +120,7 @@ This is done inside of your front controller::
// ...

Configuring the proxy server trust is very important, as not doing so will
malicious users to "spoof" their IP address.
allow malicious users to "spoof" their IP address.

My Reverse Proxy Uses Non-Standard (not X-Forwarded) Headers
------------------------------------------------------------
Expand Down

0 comments on commit 574afd5

Please sign in to comment.