@@ -9,11 +9,11 @@ For the most part, this doesn't cause any problems with Symfony. But, when
9
9
a request passes through a proxy, certain request information is sent using
10
10
special ``X-Forwarded-* `` headers. For example, instead of reading the ``REMOTE_ADDR ``
11
11
header (which will now be the IP address of your reverse proxy), the user's
12
- true IP will be stored in a ``X-Forwarded-For `` header.
12
+ true IP will be stored in an ``X-Forwarded-For `` header.
13
13
14
14
.. tip ::
15
15
16
- If your using Symfonys :ref: `AppCache<symfony-gateway-cache> ` for caching,
16
+ If you're using Symfony's :ref: `AppCache<symfony-gateway-cache> ` for caching,
17
17
then you *are * using a reverse proxy with the IP address ``127.0.0.1 ``.
18
18
You'll need to configure that address as a trusted proxy below.
19
19
@@ -38,10 +38,18 @@ and which reverse proxy IP addresses will be doing this type of thing:
38
38
39
39
.. code-block :: xml
40
40
41
- <!-- app/config/config.xyml -->
42
- <framework : config trusted-proxies =" 192.0.0.1, 10.0.0.0/8" >
43
- <!-- ... -->
44
- </framework >
41
+ <!-- app/config/config.xml -->
42
+ <?xml version =" 1.0" encoding =" UTF-8" ?>
43
+ <container xmlns =" http://symfony.com/schema/dic/services"
44
+ xmlns : xsi =" http://www.w3.org/2001/XMLSchema-instance"
45
+ xmlns : framework =" http://symfony.com/schema/dic/symfony"
46
+ xsi : schemaLocation =" http://symfony.com/schema/dic/services http://symfony.com/schema/dic/services/services-1.0.xsd
47
+ http://symfony.com/schema/dic/symfony http://symfony.com/schema/dic/symfony/symfony-1.0.xsd" >
48
+
49
+ <framework : config trusted-proxies =" 192.0.0.1, 10.0.0.0/8" >
50
+ <!-- ... -->
51
+ </framework >
52
+ </container >
45
53
46
54
.. code-block :: php
47
55
@@ -50,29 +58,27 @@ and which reverse proxy IP addresses will be doing this type of thing:
50
58
'trusted_proxies' => array('192.0.0.1', '10.0.0.0/8'),
51
59
));
52
60
53
- In this example, you're saying that your reverse proxy (or proxies) have
54
- the IP address ``192.0.0.1 `` or match the range of IP addresses that use
61
+ In this example, you're saying that your reverse proxy (or proxies) has
62
+ the IP address ``192.0.0.1 `` or matches the range of IP addresses that use
55
63
the CIDR notation ``10.0.0.0/8 ``. For more details, see :ref: `reference-framework-trusted-proxies `.
56
64
57
65
That's it! Symfony will now look for the correct ``X-Forwarded-* `` headers
58
66
to get information like the client's IP address, host, port and whether or
59
67
not the request is using HTTPS.
60
68
61
- But I the IP of my Reverse Proxy Changes Constantly!
62
- ----------------------------------------------------
69
+ But What if the IP of my Reverse Proxy Changes Constantly!
70
+ ----------------------------------------------------------
63
71
64
72
Some reverse proxies (like Amazon's Elastic Load Balancers) don't have a
65
73
static IP address or even a range that you can target with the CIDR notation.
66
74
In this case, you'll need to - *very carefully * - trust *all * proxies.
67
75
68
- 1. Configure your web server(s) to not respond to traffic from *any * servers
76
+ 1. Configure your web server(s) to * not * respond to traffic from *any * clients
69
77
other than your load balancers. For AWS, this can be done with `security groups `_.
70
78
71
79
1. Once you've guaranteed that traffic will only come from your trusted reverse
72
80
proxies, configure Symfony to *always * trust incoming request. This is
73
- done inside of your front controller:
74
-
75
- .. code-block :: php
81
+ done inside of your front controller::
76
82
77
83
// web/app.php
78
84
// ...
@@ -83,15 +89,15 @@ In this case, you'll need to - *very carefully* - trust *all* proxies.
83
89
// ...
84
90
85
91
That's it! It's critical that you prevent traffic from all non-trusted sources.
86
- If you allow outside traffic, they could "spoof" their true true IP address
87
- and other information.
92
+ If you allow outside traffic, they could "spoof" their true IP address and
93
+ other information.
88
94
89
95
My Reverse Proxy Uses Non-Standard (not X-Forwarded) Headers
90
96
------------------------------------------------------------
91
97
92
98
Most reverse proxies store information on specific ``X-Forwarded-* `` headers.
93
99
But if your reverse proxy uses non-standard header names, you can configure
94
- these. See :doc: `/components/http_foundation/trusting_proxies `. The code
95
- for doing this will need to live in your front controller (e.g. ``web/app.php ``).
100
+ these ( :doc: `see reference < /components/http_foundation/trusting_proxies >`.
101
+ The code for doing this will need to live in your front controller (e.g. ``web/app.php ``).
96
102
97
103
.. _`security groups` : http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/using-elb-security-groups.html
0 commit comments