Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Documented how to configure Symfony correctly with regards to the Forwarded header #6526

Closed
wants to merge 3 commits into from
Closed

Documented how to configure Symfony correctly with regards to the Forwarded header #6526

wants to merge 3 commits into from

Conversation

magnusnordlander
Copy link
Contributor

Q A
Doc fix? yes
New docs? no
Applies to >2.7
Fixed tickets

Ref: symfony/symfony#18688

@magnusnordlander
Documented how to configure Symfony correctlywhen
bb616be 
your reverse proxy is not handling the Forwarded
header the way Symfony expects it to.
@magnusnordlander magnusnordlander mentioned this pull request May 2, 2016
Closed
javiereguiluz
javiereguiluz reviewed May 2, 2016
View reviewed changes
cookbook/cache/varnish.rst
@@ -24,6 +24,21 @@ Remember to configure :ref:`framework.trusted_proxies <reference-framework-trust
in the Symfony configuration so that Varnish is seen as a trusted proxy and the
:ref:`X-Forwarded <varnish-x-forwarded-headers>` headers are used.

Varnish, in its' default configuration, sends the ``X-Forwarded-For`` header but
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

its' -> its

@javiereguiluz
Copy link
Member

👍 nice additions to an important topic which is probably underdocumented. Thanks @magnusnordlander

xabbuh
xabbuh reviewed May 2, 2016
View reviewed changes
cookbook/cache/varnish.rst
Varnish, in its default configuration, sends the ``X-Forwarded-For`` header but
does not filter out the ``Forwarded`` header. If you have access to the Varnish
configuration file, you can configure Varnish to remove the ``Forwarded``
header::
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One of the colons needs to be removed to make the build happy. :)

@fabpot
Copy link
Member

fabpot commented May 3, 2016

👍

wouterj
wouterj reviewed May 5, 2016
View reviewed changes
components/http_foundation/trusting_proxies.rst
stored in a ``X-Forwarded-Host`` header.
headers or the ``Forwarded`` header. For example, the ``Host`` HTTP header is
usually used to return the requested host. But when you're behind a proxy,
the true host may be stored in a ``X-Forwarded-Host`` header.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe replace "true host" with "actual host" here? (my dev. mind strongly binds true to a boolean value)

@wouterj
Copy link
Member

wouterj commented May 5, 2016

Thanks @magnusnordlander! I've left a lot of very minor comments. It would be great if you can fix these, otherwise we'll do it while merging.

xabbuh added a commit that referenced this pull request May 9, 2016
@xabbuh
minor #6526 Documented how to configure Symfony correctly with regard…
691ead1 
…s to the Forwarded header (magnusnordlander)

This PR was squashed before being merged into the 2.7 branch (closes #6526).

Discussion
----------

Documented how to configure Symfony correctly with regards to the Forwarded header

| Q             | A
| ------------- | ---
| Doc fix?      | yes
| New docs?     | no
| Applies to    | >2.7
| Fixed tickets |

Ref: symfony/symfony#18688

Commits
-------

87ab598 Documented how to configure Symfony correctly with regards to the Forwarded header
xabbuh added a commit that referenced this pull request May 9, 2016
@xabbuh
[#6526] some minor tweaks
574afd5
@xabbuh
Copy link
Member

xabbuh commented May 9, 2016

Thank you @magnusnordlander! I have squashed your commits while merging and made some minor tweaks in 574afd5.

@xabbuh xabbuh closed this May 9, 2016
xabbuh added a commit that referenced this pull request May 9, 2016
@xabbuh
Merge branch '2.7' into 2.8
ad85015 
* 2.7:
  [#6526] some minor tweaks
  Documented how to configure Symfony correctly with regards to the Forwarded header
  Improved the description of the Twig global variables
  Add a warning about using same user for cli and web server
  Correctly document new twig functions
  Updated Twig template to take into account asset() function changes
  [DependencyInjection] Unquote services FQCN in parent-services examples
xabbuh added a commit that referenced this pull request May 9, 2016
@xabbuh
Merge branch '2.8' into 3.0
3891d6b 
* 2.8:
  [#6526] some minor tweaks
  Documented how to configure Symfony correctly with regards to the Forwarded header
  Improved the description of the Twig global variables
  Add a warning about using same user for cli and web server
  Correctly document new twig functions
  Updated Twig template to take into account asset() function changes
  [DomCrawler] Removed references to CssSelector
  [DependencyInjection] Unquote services FQCN in parent-services examples
  [DependencyInjection] Unquote services FQCN in autowiring examples
xabbuh added a commit that referenced this pull request May 9, 2016
@xabbuh
Merge branch '3.0'
a5547b8 
* 3.0:
  [#6526] some minor tweaks
  Documented how to configure Symfony correctly with regards to the Forwarded header
  Improved the description of the Twig global variables
  Add a warning about using same user for cli and web server
  Correctly document new twig functions
  Updated Twig template to take into account asset() function changes
  [DomCrawler] Removed references to CssSelector
  [DependencyInjection] Unquote services FQCN in parent-services examples
  [DependencyInjection] Unquote services FQCN in autowiring examples
fabpot added a commit to symfony/symfony that referenced this pull request Jun 29, 2016
@fabpot
bug #18688 [HttpFoundation] Warning when request has both Forwarded a…
2d37230 
…nd X-Forwarded-For (magnusnordlander)

This PR was squashed before being merged into the 2.7 branch (closes #18688).

Discussion
----------

[HttpFoundation] Warning when request has both Forwarded and X-Forwarded-For

| Q             | A
| ------------- | ---
| Branch?       | 2.7
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        | symfony/symfony-docs#6526

Emit a warning when a request has both a trusted Forwarded header and a trusted X-Forwarded-For header, as this is most likely a misconfiguration which causes security issues.

Commits
-------

ee8842f [HttpFoundation] Warning when request has both Forwarded and X-Forwarded-For
symfony-splitter pushed a commit to symfony/framework-bundle that referenced this pull request Jun 29, 2016
@fabpot
bug #18688 [HttpFoundation] Warning when request has both Forwarded a…
8989695 
…nd X-Forwarded-For (magnusnordlander)

This PR was squashed before being merged into the 2.7 branch (closes #18688).

Discussion
----------

[HttpFoundation] Warning when request has both Forwarded and X-Forwarded-For

| Q             | A
| ------------- | ---
| Branch?       | 2.7
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        | symfony/symfony-docs#6526

Emit a warning when a request has both a trusted Forwarded header and a trusted X-Forwarded-For header, as this is most likely a misconfiguration which causes security issues.

Commits
-------

ee8842f [HttpFoundation] Warning when request has both Forwarded and X-Forwarded-For
symfony-splitter pushed a commit to symfony/http-kernel that referenced this pull request Jun 29, 2016
@fabpot
bug #18688 [HttpFoundation] Warning when request has both Forwarded a…
b4c9467 
…nd X-Forwarded-For (magnusnordlander)

This PR was squashed before being merged into the 2.7 branch (closes #18688).

Discussion
----------

[HttpFoundation] Warning when request has both Forwarded and X-Forwarded-For

| Q             | A
| ------------- | ---
| Branch?       | 2.7
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        | symfony/symfony-docs#6526

Emit a warning when a request has both a trusted Forwarded header and a trusted X-Forwarded-For header, as this is most likely a misconfiguration which causes security issues.

Commits
-------

ee8842f [HttpFoundation] Warning when request has both Forwarded and X-Forwarded-For
symfony-splitter pushed a commit to symfony/http-foundation that referenced this pull request Jun 29, 2016
@fabpot
bug #18688 [HttpFoundation] Warning when request has both Forwarded a…
e8fa5fe 
…nd X-Forwarded-For (magnusnordlander)

This PR was squashed before being merged into the 2.7 branch (closes #18688).

Discussion
----------

[HttpFoundation] Warning when request has both Forwarded and X-Forwarded-For

| Q             | A
| ------------- | ---
| Branch?       | 2.7
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets |
| License       | MIT
| Doc PR        | symfony/symfony-docs#6526

Emit a warning when a request has both a trusted Forwarded header and a trusted X-Forwarded-For header, as this is most likely a misconfiguration which causes security issues.

Commits
-------

ee8842f [HttpFoundation] Warning when request has both Forwarded and X-Forwarded-For
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
Status: Reviewed
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@magnusnordlander @javiereguiluz @fabpot @wouterj @xabbuh