Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork5.3k
Documented how to configure Symfony correctly with regards to the Forwarded header#6526
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Closed
Uh oh!
There was an error while loading.Please reload this page.
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.Learn more about bidirectional Unicode characters
your reverse proxy is not handling the Forwardedheader the way Symfony expects it to.
cookbook/cache/varnish.rst Outdated
| in the Symfony configuration so that Varnish is seen as a trusted proxy and the | ||
| :ref:`X-Forwarded<varnish-x-forwarded-headers>` headers are used. | ||
| Varnish, in its' default configuration, sends the ``X-Forwarded-For`` header but |
Member
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
its' ->its
Member
javiereguiluz commentedMay 2, 2016
👍 nice additions to an important topic which is probably underdocumented. Thanks@magnusnordlander |
cookbook/cache/varnish.rst Outdated
| Varnish, in its default configuration, sends the ``X-Forwarded-For`` header but | ||
| does not filter out the ``Forwarded`` header. If you have access to the Varnish | ||
| configuration file, you can configure Varnish to remove the ``Forwarded`` | ||
| header:: |
Member
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
One of the colons needs to be removed to make the build happy. :)
Member
fabpot commentedMay 3, 2016
👍 |
| stored in a ``X-Forwarded-Host`` header. | ||
| headers or the ``Forwarded`` header. For example, the ``Host`` HTTP header is | ||
| usually used to returnthe requested host. But when you're behind a proxy, | ||
| the true host may bestored in a ``X-Forwarded-Host`` header. |
Member
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Maybe replace "true host" with "actual host" here? (my dev. mind strongly binds true to a boolean value)
Member
wouterj commentedMay 5, 2016
Thanks@magnusnordlander! I've left a lot of very minor comments. It would be great if you can fix these, otherwise we'll do it while merging. |
xabbuh added a commit that referenced this pull requestMay 9, 2016
…s to the Forwarded header (magnusnordlander)This PR was squashed before being merged into the 2.7 branch (closes#6526).Discussion----------Documented how to configure Symfony correctly with regards to the Forwarded header| Q | A| ------------- | ---| Doc fix? | yes| New docs? | no| Applies to | >2.7| Fixed tickets |Ref:symfony/symfony#18688Commits-------87ab598 Documented how to configure Symfony correctly with regards to the Forwarded header
Member
xabbuh commentedMay 9, 2016
Thank you@magnusnordlander! I have squashed your commits while merging and made some minor tweaks in574afd5. |
xabbuh added a commit that referenced this pull requestMay 9, 2016
* 2.7: [#6526] some minor tweaks Documented how to configure Symfony correctly with regards to the Forwarded header Improved the description of the Twig global variables Add a warning about using same user for cli and web server Correctly document new twig functions Updated Twig template to take into account asset() function changes [DependencyInjection] Unquote services FQCN in parent-services examples
xabbuh added a commit that referenced this pull requestMay 9, 2016
* 2.8: [#6526] some minor tweaks Documented how to configure Symfony correctly with regards to the Forwarded header Improved the description of the Twig global variables Add a warning about using same user for cli and web server Correctly document new twig functions Updated Twig template to take into account asset() function changes [DomCrawler] Removed references to CssSelector [DependencyInjection] Unquote services FQCN in parent-services examples [DependencyInjection] Unquote services FQCN in autowiring examples
xabbuh added a commit that referenced this pull requestMay 9, 2016
* 3.0: [#6526] some minor tweaks Documented how to configure Symfony correctly with regards to the Forwarded header Improved the description of the Twig global variables Add a warning about using same user for cli and web server Correctly document new twig functions Updated Twig template to take into account asset() function changes [DomCrawler] Removed references to CssSelector [DependencyInjection] Unquote services FQCN in parent-services examples [DependencyInjection] Unquote services FQCN in autowiring examples
fabpot added a commit to symfony/symfony that referenced this pull requestJun 29, 2016
…nd X-Forwarded-For (magnusnordlander)This PR was squashed before being merged into the 2.7 branch (closes#18688).Discussion----------[HttpFoundation] Warning when request has both Forwarded and X-Forwarded-For| Q | A| ------------- | ---| Branch? | 2.7| Bug fix? | yes| New feature? | no| BC breaks? | no| Deprecations? | no| Tests pass? | yes| Fixed tickets || License | MIT| Doc PR |symfony/symfony-docs#6526Emit a warning when a request has both a trusted Forwarded header and a trusted X-Forwarded-For header, as this is most likely a misconfiguration which causes security issues.Commits-------ee8842f [HttpFoundation] Warning when request has both Forwarded and X-Forwarded-For
symfony-splitter pushed a commit to symfony/framework-bundle that referenced this pull requestJun 29, 2016
…nd X-Forwarded-For (magnusnordlander)This PR was squashed before being merged into the 2.7 branch (closes #18688).Discussion----------[HttpFoundation] Warning when request has both Forwarded and X-Forwarded-For| Q | A| ------------- | ---| Branch? | 2.7| Bug fix? | yes| New feature? | no| BC breaks? | no| Deprecations? | no| Tests pass? | yes| Fixed tickets || License | MIT| Doc PR |symfony/symfony-docs#6526Emit a warning when a request has both a trusted Forwarded header and a trusted X-Forwarded-For header, as this is most likely a misconfiguration which causes security issues.Commits-------ee8842f [HttpFoundation] Warning when request has both Forwarded and X-Forwarded-For
symfony-splitter pushed a commit to symfony/http-kernel that referenced this pull requestJun 29, 2016
…nd X-Forwarded-For (magnusnordlander)This PR was squashed before being merged into the 2.7 branch (closes #18688).Discussion----------[HttpFoundation] Warning when request has both Forwarded and X-Forwarded-For| Q | A| ------------- | ---| Branch? | 2.7| Bug fix? | yes| New feature? | no| BC breaks? | no| Deprecations? | no| Tests pass? | yes| Fixed tickets || License | MIT| Doc PR |symfony/symfony-docs#6526Emit a warning when a request has both a trusted Forwarded header and a trusted X-Forwarded-For header, as this is most likely a misconfiguration which causes security issues.Commits-------ee8842f [HttpFoundation] Warning when request has both Forwarded and X-Forwarded-For
symfony-splitter pushed a commit to symfony/http-foundation that referenced this pull requestJun 29, 2016
…nd X-Forwarded-For (magnusnordlander)This PR was squashed before being merged into the 2.7 branch (closes #18688).Discussion----------[HttpFoundation] Warning when request has both Forwarded and X-Forwarded-For| Q | A| ------------- | ---| Branch? | 2.7| Bug fix? | yes| New feature? | no| BC breaks? | no| Deprecations? | no| Tests pass? | yes| Fixed tickets || License | MIT| Doc PR |symfony/symfony-docs#6526Emit a warning when a request has both a trusted Forwarded header and a trusted X-Forwarded-For header, as this is most likely a misconfiguration which causes security issues.Commits-------ee8842f [HttpFoundation] Warning when request has both Forwarded and X-Forwarded-For
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ref:symfony/symfony#18688