Added new Forwarded header support for Request::getClientIps #11379

tony-co · 2014-07-11T17:57:17Z

Q	A
Bug fix?	no
New feature?	no
BC breaks?	no
Deprecations?	no
Tests pass?	yes
Fixed tickets	#11073
License	MIT
Doc PR	no

alexandresalome · 2014-07-13T10:49:47Z

You blindly trust the received headers here, whereas the previous version required the proxy to be configured as "trusted proxies". Should you configure your proxy as "trusted proxy"? see http://symfony.com/doc/current/components/http_foundation/trusting_proxies.html

tony-co · 2014-08-04T18:54:16Z

src/Symfony/Component/HttpFoundation/Request.php

+            preg_match_all('{(for)=("?\[?)([a-z0-9\.:_\-/]*)}', $forwardedHeader, $matches);
+            $clientIps = $matches[3];
+        } elseif ($this->headers->has(self::$trustedHeaders[self::HEADER_CLIENT_IP])) {
+            $clientIps = array_map('trim', explode(',', $this->headers->get(self::$trustedHeaders[self::HEADER_CLIENT_IP])));


@alexandresalome Concerning your previous comment, I am still checking the trusted headers here. Or am I missing something?

Your first test is to verify if headers contains Forwarded, but you should only trust it if the IP is a Proxy IP.

fabpot · 2014-09-24T15:28:40Z

ping @symfony/deciders

Seldaek · 2014-09-24T18:38:47Z

src/Symfony/Component/HttpFoundation/Tests/RequestTest.php

+            array(array('127.0.0.1'),                              '127.0.0.1', 'for="_gazonk"',                                      null),
+            array(array('_gazonk'),                                '127.0.0.1', 'for="_gazonk"',                                      array('127.0.0.1')),
+            array(array('192.0.2.60'),                             '::1',       'for=192.0.2.60;proto=http;by=203.0.113.43',          array('::1')),
+            array(array('2620:0:1cfe:face:b00c::3', '192.0.2.43'), '::1',       'for=192.0.2.43, for=2620:0:1cfe:face:b00c::3',       array('::1')),


Might be worth adding a test case for Forwarded: For="[2001:db8:cafe::17]:4711" returning [2001:db8:cafe::17]:4711. I don't think the current code handles it well. I also think it should preserve the [] for IPv6 as that is the common notation, but not sure if there are other precedents in symfony.

Also worth adding a test for Forwarded: For="127.0.0.1:80" which should return 127.0.0.1:80 (I think it does, but just for completeness' sake)

I've checked and it does not handle the port as is. I'll make the necessary changes.

@Seldaek I can't add a test for ips like [2001:db8:cafe::17]:4711 as it is later rejected by the IpUtils::checkIp call. What do you suggest?

@tony-co [2001:db8:cafe::17]:4711 as header should return 2001:db8:cafe::17 for the IP, not [2001:db8:cafe::17], and it will be accepted. The square brackets are not part of the IP. They are only part of teh IP+port notation, because there are :in the IP itself

Yeah sorry my initial comment was misleading I forgot that this method is called getClientIp while I was lost reading the spec :)

ping @stof Ok I added the test for [2001:db8:cafe::17]:4711. But still struggling with the 127.0.0.1:80 as the : misled the IpUtils::checkIp thinking this is an IPv6...

I guess you should strip port numbers before passing them to checkIp, since this is just about getting the IP out it makes no sense to keep port info anyway.

Seldaek · 2014-09-24T18:46:56Z

Looks good to me apart from the ipv6 thing I commented on. 👍 when that gets resolved.

Seldaek · 2014-09-24T18:48:10Z

Oh yeah another detail, there should be a doc ticket opened to at least change http://symfony.com/doc/master/cookbook/request/load_balancer_reverse_proxy.html#my-reverse-proxy-uses-non-standard-not-x-forwarded-headers to stop advertising X-Forwarded as standard IMO.

Refs symfony/symfony#11379

romainneutron · 2014-09-24T20:37:53Z

@tony-co please reabse your PR

stof · 2014-09-25T09:00:59Z

src/Symfony/Component/HttpFoundation/Request.php

-        if (!self::$trustedHeaders[self::HEADER_CLIENT_IP] || !$this->headers->has(self::$trustedHeaders[self::HEADER_CLIENT_IP])) {
-            return array($ip);
+        if (self::$trustedHeaders[self::HEADER_FORWARDED] && $this->headers->has(self::$trustedHeaders[self::HEADER_FORWARDED])) {
+            $forwardedHeader = $this->headers->get('Forwarded');


this should not use Forwarded but self::$trustedHeaders[self::HEADER_FORWARDED] here

fabpot · 2015-02-05T15:46:14Z

@tony-co Can you add the test case asked by @Seldaek ?

tony-co · 2015-02-05T23:29:02Z

@Seldaek A few weeks ago, Fabien merged a fix to strip the port.
I rebased and updated the tests to include cases with IPv4/IPv6 with ports.

Seldaek · 2015-02-06T12:34:28Z

Looks good to me I think :)

fabpot · 2015-02-08T07:21:29Z

Thank you @tony-co.

Refs symfony/symfony#11379

romainneutron added the HttpFoundation label Jul 12, 2014

tony-co reviewed Aug 4, 2014
View reviewed changes

fabpot changed the title ~~[RFR] Added new Forwarded header support for Request::getClientIps~~ Added new Forwarded header support for Request::getClientIps Aug 28, 2014

Seldaek reviewed Sep 24, 2014
View reviewed changes

tony-co added a commit to tony-co/symfony-docs that referenced this pull request Sep 24, 2014

Added support for standard Forwarded header

3205f34

Refs symfony/symfony#11379

tony-co mentioned this pull request Sep 24, 2014

Added support for standard Forwarded header symfony/symfony-docs#4266

Closed

stof reviewed Sep 25, 2014
View reviewed changes

tony-co force-pushed the added-support-forwarded-for branch from 82fbee7 to 24a309f Compare October 1, 2014 18:53

Tony Cosentino added 2 commits February 5, 2015 22:53

Added new Forwarded header support for Request::getClientIps

13f4b89

Make sure the header is trusted

7834df3

tony-co force-pushed the added-support-forwarded-for branch from 24a309f to b8ed555 Compare February 5, 2015 22:07

Updated after review

dd1a560

tony-co force-pushed the added-support-forwarded-for branch from b8ed555 to dd1a560 Compare February 5, 2015 23:18

fabpot closed this in ac389b6 Feb 8, 2015

tony-co added a commit to tony-co/symfony-docs that referenced this pull request Feb 19, 2015

Added support for standard Forwarded header

f390e9d

Refs symfony/symfony#11379

tony-co added a commit to tony-co/symfony-docs that referenced this pull request Feb 20, 2015

Added support for standard Forwarded header

0654e5a

Refs symfony/symfony#11379

javiereguiluz pushed a commit to javiereguiluz/symfony-docs that referenced this pull request Jun 11, 2015

Added support for standard Forwarded header

d452137

Refs symfony/symfony#11379

0az mentioned this pull request Apr 14, 2020

Add support for Forwarded header (RFC 7239) caddyserver/caddy#3262

Open

aldas mentioned this pull request Feb 15, 2025

feat: add Forwarded header parsing and real IP extraction with tests labstack/echo#2744

Open

Uh oh!

Added new Forwarded header support for Request::getClientIps #11379

Added new Forwarded header support for Request::getClientIps #11379

Uh oh!

Conversation

tony-co commented Jul 11, 2014

Uh oh!

alexandresalome commented Jul 13, 2014

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fabpot commented Sep 24, 2014

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Seldaek commented Sep 24, 2014

Uh oh!

Seldaek commented Sep 24, 2014

Uh oh!

romainneutron commented Sep 24, 2014

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fabpot commented Feb 5, 2015

Uh oh!

tony-co commented Feb 5, 2015

Uh oh!

Seldaek commented Feb 6, 2015

Uh oh!

fabpot commented Feb 8, 2015

Uh oh!

Uh oh!

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.