@@ -31,9 +31,8 @@ and what headers your reverse proxy uses to send information::
31
31
32
32
// tell Symfony about your reverse proxy
33
33
Request::setTrustedProxies(
34
- // you can use IP address, IP address ranges or the 'REMOTE_ADDR' string,
35
- // which is replaced at run time by the $_SERVER['REMOTE_ADDR'] env var
36
- ['192.0.0.1', '10.0.0.0/8', 'REMOTE_ADDR'],
34
+ // the IP address (or range) of your proxy
35
+ ['192.0.0.1', '10.0.0.0/8'],
37
36
38
37
// trust *all* "X-Forwarded-*" headers
39
38
Request::HEADER_X_FORWARDED_ALL
@@ -45,10 +44,6 @@ and what headers your reverse proxy uses to send information::
45
44
// Request::HEADER_X_FORWARDED_AWS_ELB
46
45
);
47
46
48
- .. versionadded :: 4.4
49
-
50
- The support for the ``REMOTE_ADDR `` env var was introduced in Symfony 4.4.
51
-
52
47
The Request object has several ``Request::HEADER_* `` constants that control exactly
53
48
*which * headers from your reverse proxy are trusted. The argument is a bit field,
54
49
so you can also pass your own value (e.g. ``0b00110 ``).
@@ -71,7 +66,7 @@ In this case, you'll need to - *very carefully* - trust *all* proxies.
71
66
// ...
72
67
Request::setTrustedProxies(
73
68
// trust *all* requests (the 'REMOTE_ADDR' string is replaced at
74
- // run time by the $_SERVER['REMOTE_ADDR'] env var )
69
+ // run time by $_SERVER['REMOTE_ADDR'])
75
70
['127.0.0.1', 'REMOTE_ADDR'],
76
71
77
72
// if you're using ELB, otherwise use a constant from above
@@ -80,7 +75,7 @@ In this case, you'll need to - *very carefully* - trust *all* proxies.
80
75
81
76
.. versionadded :: 4.4
82
77
83
- The support for the ``REMOTE_ADDR `` env var was introduced in Symfony 4.4.
78
+ The support for the ``REMOTE_ADDR `` option was introduced in Symfony 4.4.
84
79
85
80
That's it! It's critical that you prevent traffic from all non-trusted sources.
86
81
If you allow outside traffic, they could "spoof" their true IP address and
0 commit comments