fideloper/proxy

Set trusted proxies for Laravel

Wednesday, February 7, 2018
by fideloper
Repository
21 Watchers
3247 Stars
9,174,920 Installations

PHP
362 Dependents
0 Suggesters
65 Forks
16 Open issues
19 Versions
25 % Grown

The README.md

Laravel Trusted Proxies

, _(*1)

Setting a trusted proxy allows for correct URL generation, redirecting, session handling and logging in Laravel when behind a reverse proxy such as a load balancer or cache., _(*2)

Installation

Laravel 5.5+ comes with this package. If you are using Laravel 5.5 or greater, you do not need to add this to your project separately., _(*3)

Laravel 5.5 Docs (fideloper/proxy:~3.3)
Laravel 5.6 Docs (fideloper/proxy:^4.0)
Laravel 5.7 Docs (fideloper/proxy:^4.0)
Laravel 5.8 Docs (fideloper/proxy:^4.0)
Laravel 6.x Docs (fideloper/proxy:^4.0)
Laravel 7.x Docs (fideloper/proxy:^4.2)
Laravel 8.x Docs (fideloper/proxy:^4.3)
Laravel 9.x Docs (Don't use this package. Explanation here, Upgrade docs here)

Laravel 5.0 - 5.4

To install Trusted Proxy, use:, _(*4)

composer require fideloper/proxy:^3.3

Laravel 4

composer require fideloper/proxy:^2.0

Setup

Refer to the docs above for using Trusted Proxy in Laravel 5.5+. For Laravel 4.0 - 5.4, refer to the wiki., _(*5)

What Does This Do?

Setting a trusted proxy allows for correct URL generation, redirecting, session handling and logging in Laravel when behind a reverse proxy., _(*6)

This is useful if your web servers sit behind a load balancer (Nginx, HAProxy, Envoy, ELB/ALB, etc), HTTP cache (CloudFlare, Squid, Varnish, etc), or other intermediary (reverse) proxy., _(*7)

How Does This Work?

Applications behind a reverse proxy typically read some HTTP headers such as X-Forwarded, X-Forwarded-For, X-Forwarded-Proto (and more) to know about the real end-client making an HTTP request., _(*8)

If those headers were not set, then the application code would think every incoming HTTP request would be from the proxy., _(*9)

Laravel (technically the Symfony HTTP base classes) have a concept of a "trusted proxy", where those X-Forwarded headers will only be used if the source IP address of the request is known. In other words, it only trusts those headers if the proxy is trusted., _(*10)

This package creates an easier interface to that option. You can set the IP addresses of the proxies (that the application would see, so it may be a private network IP address), and the Symfony HTTP classes will know to use the X-Forwarded headers if an HTTP requets containing those headers was from the trusted proxy., _(*11)

Why Does This Matter?

A very common load balancing approach is to send https:// requests to a load balancer, but send http:// requests to the application servers behind the load balancer., _(*12)

For example, you may send a request in your browser to https://example.org. The load balancer, in turn, might send requests to an application server at http://192.168.1.23., _(*13)

What if that server returns a redirect, or generates an asset url? The users's browser would get back a redirect or HTML that includes http://192.168.1.23 in it, which is clearly wrong., _(*14)

What happens is that the application thinks its hostname is 192.168.1.23 and the schema is http://. It doesn't know that the end client used https://example.org for its web request., _(*15)

So the application needs to know to read the X-Forwarded headers to get the correct request details (schema https://, host example.org)., _(*16)

Laravel/Symfony automatically reads those headers, but only if the trusted proxy configuration is set to "trust" the load balancer/reverse proxy., _(*17)

Note: Many of us use hosted load balancers/proxies such as AWS ELB/ALB, etc. We don't know the IP address of those reverse proxies, and so you need to trusted all proxies in that case., _(*18)

The trade-off there is running the security risk of allowing people to potentially spoof the X-Forwarded headers., _(*19)

IP Addresses by Service

This Wiki page has a list of popular services and their IP addresses of their servers, if available. Any updates or suggestions are welcome!, _(*20)

The Versions

07/02 2018

dev-master

9999999-dev

Set trusted proxies for Laravel

library proxy

Set trusted proxies for Laravel

fideloper/proxy

The README.md

Laravel Trusted Proxies

Installation

Laravel 5.0 - 5.4

Laravel 4

Setup

What Does This Do?

How Does This Work?

Why Does This Matter?

IP Addresses by Service

The Versions

dev-master

The Requires

The Development Requires

by Chris Fidao

4.0.0

The Requires

The Development Requires

by Chris Fidao

dev-develop

The Requires

The Development Requires

by Chris Fidao

dev-feature/debugger

The Requires

The Development Requires

by Chris Fidao

3.3.4

The Requires

The Development Requires

by Chris Fidao

3.3.3

The Requires

The Development Requires

by Chris Fidao

3.3.2

The Requires

The Development Requires

by Chris Fidao

3.3.1

The Requires

The Development Requires

by Chris Fidao

3.3.0

The Requires

The Development Requires

by Chris Fidao

3.2.0

The Requires

The Development Requires

by Chris Fidao

3.1.0

The Requires

The Development Requires

by Chris Fidao

dev-netmask

The Requires

The Development Requires

by Chris Fidao

3.0.0

The Requires

The Development Requires

by Chris Fidao

2.1.1

The Requires

by Chris Fidao

2.1.0

The Requires

by Chris Fidao

2.0.3

The Requires

by Chris Fidao

2.0.2

The Requires

by Chris Fidao

2.0.1

The Requires