Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 18af4e8

Browse filesBrowse files
weaverryanweaverryan
committed
Adding a new entry about reverse proxies in the framework and linking to it in many places
1 parent 234fa36 commit 18af4e8
Copy full SHA for 18af4e8

File tree

Expand file treeCollapse file tree

7 files changed

+115
-3
lines changed
Filter options
Expand file treeCollapse file tree

7 files changed

+115
-3
lines changed

‎book/http_cache.rst

Copy file name to clipboardExpand all lines: book/http_cache.rst
+7-2Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,11 @@ kernel::
162162
The caching kernel will immediately act as a reverse proxy - caching responses
163163
from your application and returning them to the client.
164164

165+
Now that you're using a "proxy", you'll need to configure ``127.0.0.1`` under
166+
the ``trusted_proxies`` configuration. See
167+
:ref:`framework.trusted_proxies <reference-framework-trusted-proxies>`. Without
168+
this, the client's IP address and a few other things won't report correctly.
169+
165170
.. tip::
166171

167172
The cache kernel has a special ``getLog()`` method that returns a string
@@ -1005,8 +1010,8 @@ possible.
10051010

10061011
.. tip::
10071012

1008-
The listener only responds to local IP addresses or trusted
1009-
proxies.
1013+
The listener only responds to local IP addresses or
1014+
:doc:`trusted proxies</cookbook/request/load_balancer_reverse_proxy>`.
10101015

10111016
.. note::
10121017

‎components/http_foundation/trusting_proxies.rst

Copy file name to clipboardExpand all lines: components/http_foundation/trusting_proxies.rst
+5Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,11 @@
44
Trusting Proxies
55
================
66

7+
.. tip::
8+
9+
If you're using the Symfony Framework, start by reading
10+
:doc:`/cookbookrequest/load_balancer_reverse_proxy`.
11+
712
If you find yourself behind some sort of proxy - like a load balancer - then
813
certain header information may be sent to you using special ``X-Forwarded-*``
914
headers. For example, the ``Host`` HTTP header is usually used to return

‎cookbook/cache/varnish.rst

Copy file name to clipboardExpand all lines: cookbook/cache/varnish.rst
+9Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,13 @@ Because Symfony2's cache uses the standard HTTP cache headers, the
99
proxy. `Varnish`_ is a powerful, open-source, HTTP accelerator capable of serving
1010
cached content quickly and including support for :ref:`Edge Side Includes <edge-side-includes>`.
1111

12+
Trusting Reverse Proxies
13+
------------------------
14+
15+
For ESI to work correctly and for the :ref:`X-FORWARDED<varnish-x-forwarded-headers>`
16+
headers to be used, you need to configure Varnish as a
17+
:doc:`trusted proxy</cookbook/request/load_balancer_reverse_proxy>`.
18+
1219
.. index::
1320
single: Varnish; configuration
1421

@@ -188,6 +195,8 @@ that will invalidate the cache for a given resource:
188195
}
189196
}
190197
198+
.. _varnish-x-forwarded-headers:
199+
191200
Routing and X-FORWARDED Headers
192201
-------------------------------
193202

‎cookbook/map.rst.inc

Copy file name to clipboardExpand all lines: cookbook/map.rst.inc
+1Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,7 @@
113113

114114
* :doc:`/cookbook/request/index`
115115

116+
* :doc:`/cookbook/request/load_balancer_reverse_proxy`
116117
* :doc:`/cookbook/request/mime_type`
117118
* (session) :doc:`/cookbook/session/locale_sticky_session`
118119

‎cookbook/request/index.rst

Copy file name to clipboardExpand all lines: cookbook/request/index.rst
+1Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,5 @@ Request
44
.. toctree::
55
:maxdepth: 2
66

7+
load_balancer_reverse_proxy
78
mime_type

‎cookbook/request/load_balancer_reverse_proxy.rst

Copy file name to clipboard
+91Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
How to Configure Symfony to Work behind a Load Balancer or Reverse Proxy
2+
========================================================================
3+
4+
When you deploy your application, you may be behind a load balancer (e.g.
5+
an AWS Elastic Load Balancer) or a reverse proxy (e.g. Varnish for
6+
:doc:`caching</book/http_cache>`).
7+
8+
For the most part, this doesn't cause any problems with Symfony. But, when
9+
a request passes through a proxy, certain request information is sent using
10+
special ``X-Forwarded-*`` headers. For example, instead of reading the ``REMOTE_ADDR``
11+
header (which will now be the IP address of your reverse proxy), the user's
12+
true IP will be stored in a ``X-Forwarded-For`` header.
13+
14+
If you don't configure Symfony to look for these headers, you'll get incorrect
15+
information about the client's IP address, whether or not the client is connecting
16+
via HTTPS, the client's port and the hostname being requested.
17+
18+
Solution: trusted_proxies
19+
-------------------------
20+
21+
This is no problem, but you *do* need to tell Symfony that this is happening
22+
and which reverse proxy IP addresses will be doing this type of thing:
23+
24+
.. configuration-block::
25+
26+
.. code-block:: yaml
27+
28+
# app/config/config.yml
29+
# ...
30+
framework:
31+
trusted_proxies: [192.0.0.1, 10.0.0.0/8]
32+
33+
.. code-block:: xml
34+
35+
<!-- app/config/config.xyml -->
36+
<framework:config trusted-proxies="192.0.0.1, 10.0.0.0/8">
37+
<!-- ... -->
38+
</framework>
39+
40+
.. code-block:: php
41+
42+
// app/config/config.php
43+
$container->loadFromExtension('framework', array(
44+
'trusted_proxies' => array('192.0.0.1', '10.0.0.0/8'),
45+
));
46+
47+
In this example, you're saying that your reverse proxy (or proxies) have
48+
the IP address ``192.0.0.1`` or match the range of IP addresses that use
49+
the CIDR notation ``10.0.0.0/8``. For more details, see :ref:`reference-framework-trusted-proxies`.
50+
51+
That's it! Symfony will now look for the correct ``X-Forwarded-*`` headers
52+
to get information like the client's IP address, host, port and whether or
53+
not the request is using HTTPS.
54+
55+
But I the IP of my Reverse Proxy Changes Constantly!
56+
----------------------------------------------------
57+
58+
Some reverse proxies (like Amazon's Elastic Load Balancers) don't have a
59+
static IP address or even a range that you can target with the CIDR notation.
60+
In this case, you'll need to - *very carefully* - trust *all* proxies.
61+
62+
1. Configure your web server(s) to not respond to traffic from *any* servers
63+
other than your load balancers. For AWS, this can be done with `security groups`_.
64+
65+
1. Once you've guaranteed that traffic will only come from your trusted reverse
66+
proxies, configure Symfony to *always* trust incoming request. This is
67+
done inside of your front controller:
68+
69+
.. code-block:: php
70+
71+
// web/app.php
72+
// ...
73+
74+
Request::setTrustedProxies(array($request->server->get('REMOTE_ADDR')));
75+
76+
$response = $kernel->handle($request);
77+
// ...
78+
79+
That's it! It's critical that you prevent traffic from all non-trusted sources.
80+
If you allow outside traffic, they could "spoof" their true true IP address
81+
and other information.
82+
83+
My Reverse Proxy Uses Non-Standard (not X-Forwarded-*) Headers
84+
--------------------------------------------------------------
85+
86+
Most reverse proxies store information on specific ``X-Forwarded-*`` headers.
87+
But if your reverse proxy uses non-standard header names, you can configure
88+
these. See :doc:`/components/http_foundation/trusting_proxies`. The code
89+
for doing this will need to live in your front controller (e.g. ``web/app.php``).
90+
91+
.. _`security groups`: http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/using-elb-security-groups.html

‎reference/configuration/framework.rst

Copy file name to clipboardExpand all lines: reference/configuration/framework.rst
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,7 @@ trusted_proxies
145145
**type**: ``array``
146146

147147
Configures the IP addresses that should be trusted as proxies. For more details,
148-
see :doc:`/components/http_foundation/trusting_proxies`.
148+
see :doc:`/cookbook/request/load_balancer_reverse_proxy`.
149149

150150
.. versionadded:: 2.3
151151
CIDR notation support was introduced in Symfony 2.3, so you can whitelist whole

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.