I don't think you need this: use'0.0.0.0/0' instead and that should provide what you want.
I think we should update the documentation instead. Would you be up to submit a PR there?

@nicolas-grekas this is not equivalent. Proxies can be chained. TrustingREMOTE_ADDR is trusting the first level of proxy. Trusting the whole web allows anyone to spoof their IP address (as they can always send aForwarded header to pretend that their actual IP is a proxy one)

@mcfedr can you check whether your ELB proxies appears as an remote address belonging to the private IP range ? If yes, maybe you could trust the private IP ranges for your use case (though I don't know how isolated your AWS instances are when not using an AWS VPC).

Trusting REMOTE_ADDR is trusting the first level of proxy. Trusting the whole web allows anyone to spoof their IP address

you may be right, but I'm missing the why:

    public function isFromTrustedProxy()    {        return self::$trustedProxies && IpUtils::checkIp($this->server->get('REMOTE_ADDR'), self::$trustedProxies);    }

This only reads the direct REMOTE_ADDR. When does the difference you describe apply?

@nicolas-grekasgetClientIp cares about chained proxies.isFromTrustedProxy indeed only cares about the last hop. But that's not the only usage ofRequest::$trustedProxies.

getClientIp usesisFromTrustedProxy, so looks safe to me. Do you have a specific example of what I'm missing?

@nicolas-grekas italso uses$this->getTrustedValues when you are from a trusted proxy, which is exactly the case I'm talking about.
Trusting0.0.0.0/0 will consider any (IPv4) value as trusted.

The chain is the problem with using0.0.0.0/0 because the CDN/LB makes a request from a public IP address (in the case of cloudfront its from this massive rangehttps://ip-ranges.amazonaws.com/ip-ranges.json that changes quite often) - so I always want to trust the first level, but if the client request to cloudfront already contains ax-forwarded-for header cloudfront just extends it, so if i put0.0.0.0/0 as trusted - i've automatically trusted the proxy before cloudfront as well. (I've firewalled the servers so only CF can make requests to them)

if the client request to cloudfront already contains a x-forwarded-for header cloudfront just extends it

Oh, OK! Now I get the issue, it's related togetTrustedValues callingnormalizeAndFilterClientIps itself usingself::$trustedProxies. Thanks for your explanations and patience :)

All done.

Thank you@mcfedr.