Skip to content

Commit 89e4d9d

Browse files
committed
A bunch of changes thanks to @xabbuh and @stof
1 parent 81053ab commit 89e4d9d

File tree

4 files changed

+30
-25
lines changed

4 files changed

+30
-25
lines changed

book/http_cache.rst

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -163,9 +163,8 @@ The caching kernel will immediately act as a reverse proxy - caching responses
163163
from your application and returning them to the client.
164164

165165
Now that you're using a "proxy", you'll need to configure ``127.0.0.1`` under
166-
the ``trusted_proxies`` configuration. See
167-
:ref:`framework.trusted_proxies <reference-framework-trusted-proxies>`. Without
168-
this, the client's IP address and a few other things won't report correctly.
166+
the ``trusted_proxies`` configuration (see :ref:`reference <reference-framework-trusted-proxies>`).
167+
Without this, the client's IP address and a few other things won't report correctly.
169168

170169
.. tip::
171170

@@ -1011,7 +1010,7 @@ possible.
10111010
.. tip::
10121011

10131012
The listener only responds to local IP addresses or
1014-
:doc:`trusted proxies</cookbook/request/load_balancer_reverse_proxy>`.
1013+
:doc:`trusted proxies </cookbook/request/load_balancer_reverse_proxy>`.
10151014

10161015
.. note::
10171016

components/http_foundation/trusting_proxies.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ Trusting Proxies
77
.. tip::
88

99
If you're using the Symfony Framework, start by reading
10-
:doc:`/cookbookrequest/load_balancer_reverse_proxy`.
10+
:doc:`/cookbook/request/load_balancer_reverse_proxy`.
1111

1212
If you find yourself behind some sort of proxy - like a load balancer - then
1313
certain header information may be sent to you using special ``X-Forwarded-*``

cookbook/cache/varnish.rst

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,9 @@ cached content quickly and including support for :ref:`Edge Side Includes <edge-
1212
Trusting Reverse Proxies
1313
------------------------
1414

15-
For ESI to work correctly and for the :ref:`X-FORWARDED<varnish-x-forwarded-headers>`
15+
For ESI to work correctly and for the :ref:`X-FORWARDED <varnish-x-forwarded-headers>`
1616
headers to be used, you need to configure Varnish as a
17-
:doc:`trusted proxy</cookbook/request/load_balancer_reverse_proxy>`.
17+
:doc:`trusted proxy </cookbook/request/load_balancer_reverse_proxy>`.
1818

1919
.. index::
2020
single: Varnish; configuration

cookbook/request/load_balancer_reverse_proxy.rst

Lines changed: 24 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,11 @@ For the most part, this doesn't cause any problems with Symfony. But, when
99
a request passes through a proxy, certain request information is sent using
1010
special ``X-Forwarded-*`` headers. For example, instead of reading the ``REMOTE_ADDR``
1111
header (which will now be the IP address of your reverse proxy), the user's
12-
true IP will be stored in a ``X-Forwarded-For`` header.
12+
true IP will be stored in an ``X-Forwarded-For`` header.
1313

1414
.. tip::
1515

16-
If your using Symfonys :ref:`AppCache<symfony-gateway-cache>` for caching,
16+
If you're using Symfony's :ref:`AppCache<symfony-gateway-cache>` for caching,
1717
then you *are* using a reverse proxy with the IP address ``127.0.0.1``.
1818
You'll need to configure that address as a trusted proxy below.
1919

@@ -38,10 +38,18 @@ and which reverse proxy IP addresses will be doing this type of thing:
3838
3939
.. code-block:: xml
4040
41-
<!-- app/config/config.xyml -->
42-
<framework:config trusted-proxies="192.0.0.1, 10.0.0.0/8">
43-
<!-- ... -->
44-
</framework>
41+
<!-- app/config/config.xml -->
42+
<?xml version="1.0" encoding="UTF-8" ?>
43+
<container xmlns="http://symfony.com/schema/dic/services"
44+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
45+
xmlns:framework="http://symfony.com/schema/dic/symfony"
46+
xsi:schemaLocation="http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd
47+
http://symfony.com/schema/dic/symfony http://symfony.com/schema/dic/symfony/symfony-1.0.xsd">
48+
49+
<framework:config trusted-proxies="192.0.0.1, 10.0.0.0/8">
50+
<!-- ... -->
51+
</framework>
52+
</container>
4553
4654
.. code-block:: php
4755
@@ -50,29 +58,27 @@ and which reverse proxy IP addresses will be doing this type of thing:
5058
'trusted_proxies' => array('192.0.0.1', '10.0.0.0/8'),
5159
));
5260
53-
In this example, you're saying that your reverse proxy (or proxies) have
54-
the IP address ``192.0.0.1`` or match the range of IP addresses that use
61+
In this example, you're saying that your reverse proxy (or proxies) has
62+
the IP address ``192.0.0.1`` or matches the range of IP addresses that use
5563
the CIDR notation ``10.0.0.0/8``. For more details, see :ref:`reference-framework-trusted-proxies`.
5664

5765
That's it! Symfony will now look for the correct ``X-Forwarded-*`` headers
5866
to get information like the client's IP address, host, port and whether or
5967
not the request is using HTTPS.
6068

61-
But I the IP of my Reverse Proxy Changes Constantly!
62-
----------------------------------------------------
69+
But What if the IP of my Reverse Proxy Changes Constantly!
70+
----------------------------------------------------------
6371

6472
Some reverse proxies (like Amazon's Elastic Load Balancers) don't have a
6573
static IP address or even a range that you can target with the CIDR notation.
6674
In this case, you'll need to - *very carefully* - trust *all* proxies.
6775

68-
1. Configure your web server(s) to not respond to traffic from *any* servers
76+
1. Configure your web server(s) to *not* respond to traffic from *any* clients
6977
other than your load balancers. For AWS, this can be done with `security groups`_.
7078

7179
1. Once you've guaranteed that traffic will only come from your trusted reverse
7280
proxies, configure Symfony to *always* trust incoming request. This is
73-
done inside of your front controller:
74-
75-
.. code-block:: php
81+
done inside of your front controller::
7682

7783
// web/app.php
7884
// ...
@@ -83,15 +89,15 @@ In this case, you'll need to - *very carefully* - trust *all* proxies.
8389
// ...
8490

8591
That's it! It's critical that you prevent traffic from all non-trusted sources.
86-
If you allow outside traffic, they could "spoof" their true true IP address
87-
and other information.
92+
If you allow outside traffic, they could "spoof" their true IP address and
93+
other information.
8894

8995
My Reverse Proxy Uses Non-Standard (not X-Forwarded) Headers
9096
------------------------------------------------------------
9197

9298
Most reverse proxies store information on specific ``X-Forwarded-*`` headers.
9399
But if your reverse proxy uses non-standard header names, you can configure
94-
these. See :doc:`/components/http_foundation/trusting_proxies`. The code
95-
for doing this will need to live in your front controller (e.g. ``web/app.php``).
100+
these (:doc:`see reference </components/http_foundation/trusting_proxies>`.
101+
The code for doing this will need to live in your front controller (e.g. ``web/app.php``).
96102

97103
.. _`security groups`: http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/using-elb-security-groups.html

0 commit comments

Comments
 (0)