Laravel 5.5 Now Includes TrustedProxy | Laravel News
Laravel News
Laravel News
Laravel News
Laravel News
Blog
Tutorials
Packages
Podcast
Newsletter
Jobs
Partners
Links
Search
Laravel News
Laravel News
Search
Blog
Tutorials
Packages
Podcast
Newsletter
Facebook
Twitter
LinkedIn
Instagram
Jobs
Partners
Links
Laravel 5.5 Now Includes TrustedProxy
Tutorials
September 14th, 2017
Laravel v5.5 was released just a week ago at Laracon EU. You may have noticed that the v5.5 composer.json file requires the fideloper/proxy composer package. For me, this is one of those packages I must include immediately on every project because I use Amazon Web Services and Google Cloud every day, so I am thankful Laravel 5.5 includes this package by default.
Setting up the package is a breeze, and I especially appreciate that this package takes care of redundant setup. Let’s briefly cover what this package provides for Laravel, and why it’s an important package in the Laravel ecosystem.
What Does the TrustedProxy Package Do?
On a high level, Trusted Proxy tells Laravel about proxies that can be trusted and how to map X-Forwarded-* headers from the request.
The package readme probably does a better job summarizing:
Setting a trusted proxy allows for correct URL generation, redirecting, session handling and logging in Laravel when behind a proxy.
This is useful if your web servers sit behind a load balancer, HTTP cache, or other intermediary (reverse) proxy.
Laravel uses Symfony for handling Requests and Responses. These classes have the means to handle proxies. However, for security reasons, they must be informed of which proxies to “trust” before they will attempt to read the X-Forwarded-* headers.
Laravel does not have a simple configuration option for “trusting” proxies out of the box. This package simply provides one.
Working with Proxies
It’s commonplace for developers to need to work with cloud providers like Amazon Web Services and Content Delivery Networks (CDN) like Cloudflare for full site delivery, with the application sitting behind these services instead of being exposed directly to the world. Also, your application might even be behind a chain of proxies.
When your website or application has DNS pointed at CloudFlare, for example, the HTTP requests get proxied from CloudFlare to your application.
For example, ou might notice a few CloudFlare headers in the HTTP responses on Laravel News:
1$ curl -I https://laravel-news.com/laravel-5-52HTTP/1.1 200 OK3Date: Wed, 13 Sep 2017 04:15:50 GMT4Content-Type: text/html; charset=UTF-85Connection: keep-alive6Cache-Control: no-cache7Server: cloudflare-nginx8CF-RAY: 39d849a3df7a39e2-PHX
You can see a couple headers (CF-RAY and Server for example) being sent back in the cURL response. CloudFlare is proxying the request to the actual application, getting the response, appending a few headers, and sending the response back to the end-user.
Since CloudFlare is proxying between the end user and the application, all requests look the same to the application. To let the application know important details about the originating request, proxies send along X-Forwarded* headers.
Here are a few common headers that proxies will send along:
X-Forwarded-For – a standard header for defining the originating IP address (reference)
X-Forwarded-Host – a de-facto standard header for identifying the original host requested by the client in the Host HTTP header (reference)
X-Forwarded-Proto – a de-facto standard header for identifying the protocol, such as HTTP or HTTPS (reference)
X-Forwarded-Port – helps you identify the port that the client used to connect to the load balancer (reference)
Not all proxies use the de-facto standard headers, but this package can help you map those headers so that the underlying Symfony request object knows how to trust the proxy and get the correct values.
HTTPS -> HTTP
If you terminate TLS/SSL at the load-balancer level, your application might receive requests internally on HTTP, but actually the originating request from users is HTTPS. If you are in this situation, your application will receive header like this (among others) from the proxy:
1X-Forwarded-Proto: https
The TrustProxies middleware automatically makes the Request object aware of the proxy headers by calling Symfony’s HttpFoundation Request::setTrustedProxies() method, and thus any PHP-generated URIs will know to use HTTPS, even though the request was made via HTTP. Without calling setTrustedProxies(), a Laravel application wouldn’t know about the originating request and how to properly deal with that request.
Configuration
The fideloper/proxy package provides the following Laravel configuration so you can adapt the package to work in a variety of settings, including providing mapping if your proxies use non-standard header names:
1<?php 2 3return [ 4 5 /* 6 * Set trusted proxy IP addresses. 7 * 8 * Both IPv4 and IPv6 addresses are 9 * supported, along with CIDR notation.10 *11 * The "*" character is syntactic sugar12 * within TrustedProxy to trust any proxy13 * that connects directly to your server,14 * a requirement when you cannot know the address15 * of your proxy (e.g. if using Rackspace balancers).16 *17 * The "**" character is syntactic sugar within18 * TrustedProxy to trust not just any proxy that19 * connects directly to your server, but also20 * proxies that connect to those proxies, and all21 * the way back until you reach the original source22 * IP. It will mean that $request->getClientIp()23 * always gets the originating client IP, no matter24 * how many proxies that client's request has25 * subsequently passed through.26 */27 'proxies' => [28 '192.168.1.10',29 ],3031 /*32 * Or, to trust all proxies that connect33 * directly to your server, uncomment this:34 */35 # 'proxies' => '*',3637 /*38 * Or, to trust ALL proxies, including those that39 * are in a chain of forwarding, uncomment this:40 */41 # 'proxies' => '**',4243 /*44 * Default Header Names45 *46 * Change these if the proxy does47 * not send the default header names.48 *49 * Note that headers such as X-Forwarded-For50 * are transformed to HTTP_X_FORWARDED_FOR format.51 *52 * The following are Symfony defaults, found in53 * \Symfony\Component\HttpFoundation\Request::$trustedHeaders54 *55 * You may optionally set headers to 'null' here if you'd like56 * for them to be considered untrusted instead. Ex:57 *58 * Illuminate\Http\Request::HEADER_CLIENT_HOST => null,59 *60 * WARNING: If you're using AWS Elastic Load Balancing or Heroku,61 * the FORWARDED and X_FORWARDED_HOST headers should be set to null62 * as they are currently unsupported there.63 */64 'headers' => [65 (defined('Illuminate\Http\Request::HEADER_FORWARDED') ? Illuminate\Http\Request::HEADER_FORWARDED : 'forwarded') => 'FORWARDED',66 Illuminate\Http\Request::HEADER_CLIENT_IP => 'X_FORWARDED_FOR',67 Illuminate\Http\Request::HEADER_CLIENT_HOST => 'X_FORWARDED_HOST',68 Illuminate\Http\Request::HEADER_CLIENT_PROTO => 'X_FORWARDED_PROTO',69 Illuminate\Http\Request::HEADER_CLIENT_PORT => 'X_FORWARDED_PORT',70 ]71];
The configuration allows you to define the IP addresses you want to trust, or you can trust all direct proxies with * and any proxy in a chain of proxies with **. Please consult the documentation carefully, as well as the final part of this article to read about locking down your applications that are behind proxies.
You can create the config/trustedproxy.php configuration by running vendor:publish:
1php artisan vendor:publish --provider="Fideloper\Proxy\TrustedProxyServiceProvider"
In Laravel 5.5, running vendor:publish without arguments will use an interactive mode which makes publishing the vendor file even easier.
Learn More
Symfony has a short write-up How to Configure Symfony to Work behind a Load Balancer or Reverse Proxy with some valuable information. Specifically, the following security considerations are crucial when working with proxies:
Some reverse proxies (like Amazon’s Elastic Load Balancers) don’t have a static IP address or even a range that you can target with the CIDR notation. In this case, you’ll need to – very carefully – trust all proxies.
Configure your web server(s) to not respond to traffic from any clients other than your load balancers. For AWS, this can be done with security groups.
Once you’ve guaranteed that traffic will only come from your trusted reverse proxies, configure Symfony to always trust incoming request.
Check out fideloper/proxy, which has an extensive readme on how to set up the TrustProxies middleware and configuration with a ton of information on the subject.
Filed in:
Tutorials
Paul Redmond
Full stack web developer. Author of Lumen Programming Guide and Docker for PHP Developers.
Laravel News Partners
response.text()).then(html => $el.innerHTML = html)" class="flex flex-wrap items-center justify-center">
Laravel News Partners
response.text()).then(html => $el.innerHTML = html)" class="flex flex-wrap items-center justify-center">
Newsletter
Join 33,000+ others and never miss out on new tips, tutorials, and more.
Subscribe
Laravel Jobs
The official Laravel job board connecting the best jobs with top talent.
View All Jobs
{ laravelnews.domDuplicator($el) }" x-data="{}">
Laravel Developer (US only)
Senior Full Stack Engineer
Laravel Developer
[German-speaking only] Laravel Junior + Senior Dev TALL Stack
Lead Engineer, Backend
Full Time Laravel Developer
Senior Full-Stack Developer
Senior Software Engineer (Laravel/Javascript)
Web Applications Engineer
Full Stack - Laravel Developer
Application Developer - front end focused
SR Software Engineer Architect
Senior Laravel Dev with Vue.js experience
Senior PHP developer - Netherlands
Senior Full Stack Engineer
Most recent
response.text()).then(html => $el.innerHTML = html)" class="lg:gap-16 sm:gap-8 grid grid-cols-12 col-span-10 col-start-2 gap-6">
December 16th, 2022
Laravel 9.44 is released with native support for changing database columns and more
December 15th, 2022
Steve vs Matt — How two developers approach the same problem
December 14th, 2022
A Look at What's Coming to Laravel 10
Subscribe to the Email Newsletter
Subscribe
Follow Laravel News on
Facebook
Twitter
LinkedIn
Instagram
Design & development by
Newsletter
Tutorials
Training Resources
Laravel Consultants
Partners
Advertising
Login
Contact
Stats by Fathom
2012 - 2022 Laravel News
A division of dotdev inc.