Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 8a4eb65

Browse filesBrowse files
jderussejderusse
committed
Deprecate HEADER_X_FORWARDED_ALL constant
1 parent 8bac7a0 commit 8a4eb65
Copy full SHA for 8a4eb65

File tree

11 files changed

+72
-28
lines changed
Filter options

11 files changed

+72
-28
lines changed

‎UPGRADE-5.3.md

Copy file name to clipboard
+12Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
UPGRADE FROM 5.2 to 5.3
2+
=======================
3+
4+
FrameworkBundle
5+
---------------
6+
7+
* Deprecated the `x-forwarded-all` option. Use a combination of `x-forwarded-*` options instead.
8+
9+
HttpFoundation
10+
--------------
11+
12+
* Deprecated the `Request::HEADER_X_FORWARDED_ALL` constant. Use a combination of `HEADER_X_FORWARDED_*` constants instead.

‎UPGRADE-6.0.md

Copy file name to clipboardExpand all lines: UPGRADE-6.0.md
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@ FrameworkBundle
5959
* The `form.factory`, `form.type.file`, `translator`, `security.csrf.token_manager`, `serializer`,
6060
`cache_clearer`, `filesystem` and `validator` services are now private.
6161
* Removed the `lock.RESOURCE_NAME` and `lock.RESOURCE_NAME.store` services and the `lock`, `LockInterface`, `lock.store` and `PersistingStoreInterface` aliases, use `lock.RESOURCE_NAME.factory`, `lock.factory` or `LockFactory` instead.
62+
* Removed the `x-forwarded-all` option.
6263

6364
HttpFoundation
6465
--------------
@@ -67,6 +68,7 @@ HttpFoundation
6768
`RedirectResponse::create()`, and `StreamedResponse::create()` methods (use
6869
`__construct()` instead)
6970
* Not passing a `Closure` together with `FILTER_CALLBACK` to `ParameterBag::filter()` throws an `InvalidArgumentException`; wrap your filter in a closure instead.
71+
* Removed the `Request::HEADER_X_FORWARDED_ALL` constant. Use a combination of `HEADER_X_FORWARDED_*` constants instead.
7072

7173
HttpKernel
7274
----------

‎src/Symfony/Bridge/Monolog/Tests/Processor/WebProcessorTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Bridge/Monolog/Tests/Processor/WebProcessorTest.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ public function testUsesRequestServerData()
3838

3939
public function testUseRequestClientIp()
4040
{
41-
Request::setTrustedProxies(['192.168.0.1'], Request::HEADER_X_FORWARDED_ALL);
41+
Request::setTrustedProxies(['192.168.0.1'], Request::HEADER_X_FORWARDED_FOR);
4242
[$event, $server] = $this->createRequestEvent(['X_FORWARDED_FOR' => '192.168.0.2']);
4343

4444
$processor = new WebProcessor();

‎src/Symfony/Bundle/FrameworkBundle/CHANGELOG.md

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/FrameworkBundle/CHANGELOG.md
+6Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,12 @@
11
CHANGELOG
22
=========
33

4+
5.3.0
5+
-----
6+
7+
* Deprecated the `x-forwarded-all` option. Use `x-forwarded-*` instead.
8+
9+
410
5.2.0
511
-----
612

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ public function getConfigTreeBuilder()
9292
->arrayNode('trusted_headers')
9393
->fixXmlConfig('trusted_header')
9494
->performNoDeepMerging()
95-
->defaultValue(['x-forwarded-all', '!x-forwarded-host', '!x-forwarded-prefix'])
95+
->defaultValue(['x-forwarded-for', 'x-forwarded-port', 'x-forwarded-proto'])
9696
->beforeNormalization()->ifString()->then(function ($v) { return $v ? array_map('trim', explode(',', $v)) : []; })->end()
9797
->enumPrototype()
9898
->values([

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php
+2-1Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2296,10 +2296,11 @@ private function resolveTrustedHeaders(array $headers): int
22962296
case 'x-forwarded-port': $trustedHeaders |= Request::HEADER_X_FORWARDED_PORT; break;
22972297
case '!x-forwarded-host': $trustedHeaders &= ~Request::HEADER_X_FORWARDED_HOST; break;
22982298
case 'x-forwarded-all':
2299+
trigger_deprecation('symfony/framework-bundle', '5.3', 'The "x-forwarded-all" configuration option is deprecated, Use a combination of "x-forwarded-*" options instead.');
22992300
if (!\in_array('!x-forwarded-prefix', $headers)) {
23002301
throw new LogicException('When using "x-forwarded-all" in "framework.trusted_headers", "!x-forwarded-prefix" must be explicitly listed until support for X-Forwarded-Prefix is implemented.');
23012302
}
2302-
$trustedHeaders |= Request::HEADER_X_FORWARDED_ALL;
2303+
$trustedHeaders |= Request::HEADER_X_FORWARDED_FOR | Request::HEADER_X_FORWARDED_HOST | Request::HEADER_X_FORWARDED_PORT | Request::HEADER_X_FORWARDED_PROTO;
23032304
break;
23042305
}
23052306
}

‎src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/ConfigurationTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/ConfigurationTest.php
+3-3Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -341,9 +341,9 @@ protected static function getBundleDefaultConfig()
341341
'secret' => 's3cr3t',
342342
'trusted_hosts' => [],
343343
'trusted_headers' => [
344-
'x-forwarded-all',
345-
'!x-forwarded-host',
346-
'!x-forwarded-prefix',
344+
'x-forwarded-for',
345+
'x-forwarded-port',
346+
'x-forwarded-proto',
347347
],
348348
'csrf_protection' => [
349349
'enabled' => false,

‎src/Symfony/Component/HttpFoundation/CHANGELOG.md

Copy file name to clipboardExpand all lines: src/Symfony/Component/HttpFoundation/CHANGELOG.md
+5Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
CHANGELOG
22
=========
33

4+
5.3.0
5+
-----
6+
7+
* Deprecated the `Request::HEADER_X_FORWARDED_ALL` constant. Use a combination of `HEADER_X_FORWARDED_*` constants instead.
8+
49
5.2.0
510
-----
611

‎src/Symfony/Component/HttpFoundation/Request.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/HttpFoundation/Request.php
+15-10Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -40,16 +40,18 @@ class_exists(ServerBag::class);
4040
*/
4141
class Request
4242
{
43-
const HEADER_FORWARDED = 0b000001; // When using RFC 7239
44-
const HEADER_X_FORWARDED_FOR = 0b000010;
45-
const HEADER_X_FORWARDED_HOST = 0b000100;
46-
const HEADER_X_FORWARDED_PROTO = 0b001000;
47-
const HEADER_X_FORWARDED_PORT = 0b010000;
48-
const HEADER_X_FORWARDED_PREFIX = 0b100000;
49-
50-
const HEADER_X_FORWARDED_ALL = 0b011110; // All "X-Forwarded-*" headers sent by "usual" reverse proxy
51-
const HEADER_X_FORWARDED_AWS_ELB = 0b011010; // AWS ELB doesn't send X-Forwarded-Host
52-
const HEADER_X_FORWARDED_TRAEFIK = 0b111110; // All "X-Forwarded-*" headers sent by Traefik reverse proxy
43+
const HEADER_FORWARDED = 0b0000001; // When using RFC 7239
44+
const HEADER_X_FORWARDED_FOR = 0b0000010;
45+
const HEADER_X_FORWARDED_HOST = 0b0000100;
46+
const HEADER_X_FORWARDED_PROTO = 0b0001000;
47+
const HEADER_X_FORWARDED_PORT = 0b0010000;
48+
const HEADER_X_FORWARDED_PREFIX = 0b0100000;
49+
private const CONST_DEPRECATED = 0b10000000; // reserved to deprecate constants
50+
51+
/** @deprecated since Symfony 5.3, to be removed in 6.0. Use a combination of HEADER_X_FORWARDED_* constants instead. */
52+
const HEADER_X_FORWARDED_ALL = 0b10011110; // All "X-Forwarded-*" headers sent by "usual" reverse proxy
53+
const HEADER_X_FORWARDED_AWS_ELB = 0b00011010; // AWS ELB doesn't send X-Forwarded-Host
54+
const HEADER_X_FORWARDED_TRAEFIK = 0b00111110; // All "X-Forwarded-*" headers sent by Traefik reverse proxy
5355

5456
const METHOD_HEAD = 'HEAD';
5557
const METHOD_GET = 'GET';
@@ -593,6 +595,9 @@ public function overrideGlobals()
593595
*/
594596
public static function setTrustedProxies(array $proxies, int $trustedHeaderSet)
595597
{
598+
if (self::HEADER_X_FORWARDED_ALL === $trustedHeaderSet) {
599+
trigger_deprecation('symfony/http-fundation', '5.3', 'The "HEADER_X_FORWARDED_ALL" constant is deprecated, Use a combination of `HEADER_X_FORWARDED_*` constants instead.');
600+
}
596601
self::$trustedProxies = array_reduce($proxies, function ($proxies, $proxy) {
597602
if ('REMOTE_ADDR' !== $proxy) {
598603
$proxies[] = $proxy;

‎src/Symfony/Component/HttpFoundation/Tests/RequestTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/HttpFoundation/Tests/RequestTest.php
+24-11Lines changed: 24 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
namespace Symfony\Component\HttpFoundation\Tests;
1313

1414
use PHPUnit\Framework\TestCase;
15+
use Symfony\Bridge\PhpUnit\ExpectDeprecationTrait;
1516
use Symfony\Component\HttpFoundation\Exception\JsonException;
1617
use Symfony\Component\HttpFoundation\Exception\SuspiciousOperationException;
1718
use Symfony\Component\HttpFoundation\InputBag;
@@ -22,6 +23,8 @@
2223

2324
class RequestTest extends TestCase
2425
{
26+
use ExpectDeprecationTrait;
27+
2528
protected function tearDown(): void
2629
{
2730
Request::setTrustedProxies([], -1);
@@ -867,7 +870,7 @@ public function testGetPort()
867870

868871
$this->assertEquals(80, $port, 'Without trusted proxies FORWARDED_PROTO and FORWARDED_PORT are ignored.');
869872

870-
Request::setTrustedProxies(['1.1.1.1'], Request::HEADER_X_FORWARDED_ALL);
873+
Request::setTrustedProxies(['1.1.1.1'], Request::HEADER_X_FORWARDED_PROTO | Request::HEADER_X_FORWARDED_PORT);
871874
$request = Request::create('http://example.com', 'GET', [], [], [], [
872875
'HTTP_X_FORWARDED_PROTO' => 'https',
873876
'HTTP_X_FORWARDED_PORT' => '8443',
@@ -1091,7 +1094,7 @@ public function testGetClientIpsWithConflictingHeaders($httpForwarded, $httpXFor
10911094
'HTTP_X_FORWARDED_FOR' => $httpXForwardedFor,
10921095
];
10931096

1094-
Request::setTrustedProxies(['88.88.88.88'], Request::HEADER_X_FORWARDED_ALL | Request::HEADER_FORWARDED);
1097+
Request::setTrustedProxies(['88.88.88.88'], Request::HEADER_X_FORWARDED_FOR | Request::HEADER_FORWARDED);
10951098

10961099
$request->initialize([], [], [], [], [], $server);
10971100

@@ -1349,7 +1352,7 @@ public function testOverrideGlobals()
13491352

13501353
$request->headers->set('X_FORWARDED_PROTO', 'https');
13511354

1352-
Request::setTrustedProxies(['1.1.1.1'], Request::HEADER_X_FORWARDED_ALL);
1355+
Request::setTrustedProxies(['1.1.1.1'], Request::HEADER_X_FORWARDED_PROTO);
13531356
$this->assertFalse($request->isSecure());
13541357
$request->server->set('REMOTE_ADDR', '1.1.1.1');
13551358
$this->assertTrue($request->isSecure());
@@ -1830,7 +1833,7 @@ private function getRequestInstanceForClientIpTests(string $remoteAddr, ?string
18301833
}
18311834

18321835
if ($trustedProxies) {
1833-
Request::setTrustedProxies($trustedProxies, Request::HEADER_X_FORWARDED_ALL);
1836+
Request::setTrustedProxies($trustedProxies, Request::HEADER_X_FORWARDED_FOR);
18341837
}
18351838

18361839
$request->initialize([], [], [], [], [], $server);
@@ -1873,35 +1876,35 @@ public function testTrustedProxiesXForwardedFor()
18731876
$this->assertFalse($request->isSecure());
18741877

18751878
// disabling proxy trusting
1876-
Request::setTrustedProxies([], Request::HEADER_X_FORWARDED_ALL);
1879+
Request::setTrustedProxies([], Request::HEADER_X_FORWARDED_FOR);
18771880
$this->assertEquals('3.3.3.3', $request->getClientIp());
18781881
$this->assertEquals('example.com', $request->getHost());
18791882
$this->assertEquals(80, $request->getPort());
18801883
$this->assertFalse($request->isSecure());
18811884

18821885
// request is forwarded by a non-trusted proxy
1883-
Request::setTrustedProxies(['2.2.2.2'], Request::HEADER_X_FORWARDED_ALL);
1886+
Request::setTrustedProxies(['2.2.2.2'], Request::HEADER_X_FORWARDED_FOR);
18841887
$this->assertEquals('3.3.3.3', $request->getClientIp());
18851888
$this->assertEquals('example.com', $request->getHost());
18861889
$this->assertEquals(80, $request->getPort());
18871890
$this->assertFalse($request->isSecure());
18881891

18891892
// trusted proxy via setTrustedProxies()
1890-
Request::setTrustedProxies(['3.3.3.3', '2.2.2.2'], Request::HEADER_X_FORWARDED_ALL);
1893+
Request::setTrustedProxies(['3.3.3.3', '2.2.2.2'], Request::HEADER_X_FORWARDED_FOR | Request::HEADER_X_FORWARDED_HOST | Request::HEADER_X_FORWARDED_PORT | Request::HEADER_X_FORWARDED_PROTO);
18911894
$this->assertEquals('1.1.1.1', $request->getClientIp());
18921895
$this->assertEquals('foo.example.com', $request->getHost());
18931896
$this->assertEquals(443, $request->getPort());
18941897
$this->assertTrue($request->isSecure());
18951898

18961899
// trusted proxy via setTrustedProxies()
1897-
Request::setTrustedProxies(['3.3.3.4', '2.2.2.2'], Request::HEADER_X_FORWARDED_ALL);
1900+
Request::setTrustedProxies(['3.3.3.4', '2.2.2.2'], Request::HEADER_X_FORWARDED_FOR | Request::HEADER_X_FORWARDED_HOST | Request::HEADER_X_FORWARDED_PORT | Request::HEADER_X_FORWARDED_PROTO);
18981901
$this->assertEquals('3.3.3.3', $request->getClientIp());
18991902
$this->assertEquals('example.com', $request->getHost());
19001903
$this->assertEquals(80, $request->getPort());
19011904
$this->assertFalse($request->isSecure());
19021905

19031906
// check various X_FORWARDED_PROTO header values
1904-
Request::setTrustedProxies(['3.3.3.3', '2.2.2.2'], Request::HEADER_X_FORWARDED_ALL);
1907+
Request::setTrustedProxies(['3.3.3.3', '2.2.2.2'], Request::HEADER_X_FORWARDED_PROTO);
19051908
$request->headers->set('X_FORWARDED_PROTO', 'ssl');
19061909
$this->assertTrue($request->isSecure());
19071910

@@ -2377,7 +2380,7 @@ public function testTrustedPort()
23772380

23782381
public function testTrustedPortDoesNotDefaultToZero()
23792382
{
2380-
Request::setTrustedProxies(['1.1.1.1'], Request::HEADER_X_FORWARDED_ALL);
2383+
Request::setTrustedProxies(['1.1.1.1'], Request::HEADER_X_FORWARDED_FOR);
23812384

23822385
$request = Request::create('/');
23832386
$request->server->set('REMOTE_ADDR', '1.1.1.1');
@@ -2393,7 +2396,7 @@ public function testTrustedPortDoesNotDefaultToZero()
23932396
public function testTrustedProxiesRemoteAddr($serverRemoteAddr, $trustedProxies, $result)
23942397
{
23952398
$_SERVER['REMOTE_ADDR'] = $serverRemoteAddr;
2396-
Request::setTrustedProxies($trustedProxies, Request::HEADER_X_FORWARDED_ALL);
2399+
Request::setTrustedProxies($trustedProxies, Request::HEADER_X_FORWARDED_FOR);
23972400
$this->assertSame($result, Request::getTrustedProxies());
23982401
}
23992402

@@ -2464,6 +2467,16 @@ public function preferSafeContentData()
24642467
],
24652468
];
24662469
}
2470+
2471+
/**
2472+
* @group legacy
2473+
*/
2474+
public function testXForwarededAllConstantDeprecated()
2475+
{
2476+
$this->expectDeprecation('Since symfony/http-fundation 5.3: The "HEADER_X_FORWARDED_ALL" constant is deprecated, Use a combination of `HEADER_X_FORWARDED_*` constants instead.');
2477+
2478+
Request::setTrustedProxies([], Request::HEADER_X_FORWARDED_ALL);
2479+
}
24672480
}
24682481

24692482
class RequestContentProxy extends Request

‎src/Symfony/Component/HttpKernel/Tests/HttpCache/HttpCacheTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Component/HttpKernel/Tests/HttpCache/HttpCacheTest.php
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1361,7 +1361,7 @@ public function testClientIpIsAlwaysLocalhostForForwardedRequests()
13611361
*/
13621362
public function testHttpCacheIsSetAsATrustedProxy(array $existing)
13631363
{
1364-
Request::setTrustedProxies($existing, Request::HEADER_X_FORWARDED_ALL);
1364+
Request::setTrustedProxies($existing, Request::HEADER_X_FORWARDED_FOR);
13651365

13661366
$this->setNextResponse();
13671367
$this->request('GET', '/', ['REMOTE_ADDR' => '10.0.0.1']);

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.