@@ -9,11 +9,11 @@ For the most part, this doesn't cause any problems with Symfony. But, when
99a request passes through a proxy, certain request information is sent using
1010special ``X-Forwarded-* `` headers. For example, instead of reading the ``REMOTE_ADDR ``
1111header (which will now be the IP address of your reverse proxy), the user's
12- true IP will be stored in a ``X-Forwarded-For `` header.
12+ true IP will be stored in an ``X-Forwarded-For `` header.
1313
1414.. tip ::
1515
16- If your using Symfonys :ref: `AppCache<symfony-gateway-cache> ` for caching,
16+ If you're using Symfony's :ref: `AppCache<symfony-gateway-cache> ` for caching,
1717 then you *are * using a reverse proxy with the IP address ``127.0.0.1 ``.
1818 You'll need to configure that address as a trusted proxy below.
1919
@@ -38,10 +38,18 @@ and which reverse proxy IP addresses will be doing this type of thing:
3838
3939 .. code-block :: xml
4040
41- <!-- app/config/config.xyml -->
42- <framework : config trusted-proxies =" 192.0.0.1, 10.0.0.0/8" >
43- <!-- ... -->
44- </framework >
41+ <!-- app/config/config.xml -->
42+ <?xml version =" 1.0" encoding =" UTF-8" ?>
43+ <container xmlns =" http://symfony.com/schema/dic/services"
44+ xmlns : xsi =" http://www.w3.org/2001/XMLSchema-instance"
45+ xmlns : framework =" http://symfony.com/schema/dic/symfony"
46+ xsi : schemaLocation =" http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd
47+ http://symfony.com/schema/dic/symfony http://symfony.com/schema/dic/symfony/symfony-1.0.xsd" >
48+
49+ <framework : config trusted-proxies =" 192.0.0.1, 10.0.0.0/8" >
50+ <!-- ... -->
51+ </framework >
52+ </container >
4553
4654 .. code-block :: php
4755
@@ -50,29 +58,27 @@ and which reverse proxy IP addresses will be doing this type of thing:
5058 'trusted_proxies' => array('192.0.0.1', '10.0.0.0/8'),
5159 ));
5260
53- In this example, you're saying that your reverse proxy (or proxies) have
54- the IP address ``192.0.0.1 `` or match the range of IP addresses that use
61+ In this example, you're saying that your reverse proxy (or proxies) has
62+ the IP address ``192.0.0.1 `` or matches the range of IP addresses that use
5563the CIDR notation ``10.0.0.0/8 ``. For more details, see :ref: `reference-framework-trusted-proxies `.
5664
5765That's it! Symfony will now look for the correct ``X-Forwarded-* `` headers
5866to get information like the client's IP address, host, port and whether or
5967not the request is using HTTPS.
6068
61- But I the IP of my Reverse Proxy Changes Constantly!
62- ----------------------------------------------------
69+ But What if the IP of my Reverse Proxy Changes Constantly!
70+ ----------------------------------------------------------
6371
6472Some reverse proxies (like Amazon's Elastic Load Balancers) don't have a
6573static IP address or even a range that you can target with the CIDR notation.
6674In this case, you'll need to - *very carefully * - trust *all * proxies.
6775
68- 1. Configure your web server(s) to not respond to traffic from *any * servers
76+ 1. Configure your web server(s) to * not * respond to traffic from *any * clients
6977 other than your load balancers. For AWS, this can be done with `security groups `_.
7078
71791. Once you've guaranteed that traffic will only come from your trusted reverse
7280 proxies, configure Symfony to *always * trust incoming request. This is
73- done inside of your front controller:
74-
75- .. code-block :: php
81+ done inside of your front controller::
7682
7783 // web/app.php
7884 // ...
@@ -83,15 +89,15 @@ In this case, you'll need to - *very carefully* - trust *all* proxies.
8389 // ...
8490
8591That's it! It's critical that you prevent traffic from all non-trusted sources.
86- If you allow outside traffic, they could "spoof" their true true IP address
87- and other information.
92+ If you allow outside traffic, they could "spoof" their true IP address and
93+ other information.
8894
8995My Reverse Proxy Uses Non-Standard (not X-Forwarded) Headers
9096------------------------------------------------------------
9197
9298Most reverse proxies store information on specific ``X-Forwarded-* `` headers.
9399But if your reverse proxy uses non-standard header names, you can configure
94- these. See :doc: `/components/http_foundation/trusting_proxies `. The code
95- for doing this will need to live in your front controller (e.g. ``web/app.php ``).
100+ these ( :doc: `see reference < /components/http_foundation/trusting_proxies >`.
101+ The code for doing this will need to live in your front controller (e.g. ``web/app.php ``).
96102
97103.. _`security groups` : http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/using-elb-security-groups.html
0 commit comments