Repository navigation
fix(frankenphp): give PHP the visitor IP and HTTPS behind a proxy - #62
Merged
Merged
Conversation
Caddy resolved the visitor through trusted_proxies (private ranges and
Cloudflare), but only for its own {client_ip}: PHP still got the proxy's
address as REMOTE_ADDR, the raw X-Forwarded-For and no HTTPS. Behind
Cloudflare and Traefik, Symfony then saw Traefik's IP with no trusted
proxies, or the Cloudflare edge IP with private_ranges, which doesn't
include Cloudflare's ranges.
Like mod_remoteip in the Apache images, php_server now sets REMOTE_ADDR to
{client_ip} and HTTPS to "on" when the request was served over HTTPS or
forwarded with X-Forwarded-Proto: https, and X-Forwarded-For is removed so
PHP doesn't walk the chain again.
The README gets a "Running Behind a Reverse Proxy" section: what the images
trust, the Traefik setting Cloudflare needs, and which Symfony
trusted_proxies values to use.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Caddy resolves the visitor through
trusted_proxies(private ranges + Cloudflare), but only for its own{client_ip}. PHP still got the proxy's address asREMOTE_ADDR, the rawX-Forwarded-Forand noHTTPS, so Symfony either saw Traefik's IP or, withprivate_ranges, the Cloudflare edge IP (Symfony doesn't know Cloudflare's ranges).Like
mod_remoteipin the Apache images,php_servernow gets:REMOTE_ADDR={client_ip}(the visitor, resolved right to left through the trusted chain)HTTPS=onwhen the request is served over HTTPS or forwarded withX-Forwarded-Proto: httpsX-Forwarded-For, so PHP doesn't walk the chain a second timeThe README gets a Running Behind a Reverse Proxy section: what the images trust, the Traefik
forwardedHeaders.trustedIPssetting Cloudflare needs, and which Symfonytrusted_proxiesvalues to use.Tested on the real Cloudflare → Traefik → container chain
On the SILARHI server, the published
8.5-frankenphp-bookwormimage plus this Caddyfile was run as two temporary containers behind the production Traefik (websecuretrusts exactly Cloudflare's 22 published ranges), atlabs.silarhi.fr/proxytest(classic) and/proxytest-worker(symfony-worker-native.Caddyfile). A Symfony 8.1 app reported whatRequestsees with eachtrusted_proxiesvalue. Removed afterwards./frankenphp)REMOTE_ADDR= Traefik172.18.0.12,HTTPSemptyREMOTE_ADDR= my IP,HTTPS=ontrusted_proxiesemptyhttp://https://labs.silarhi.frprivate_rangeshttps://https://labs.silarhi.frX-Forwarded-For: 6.6.6.6/X-Forwarded-Proto: httpthrough CloudflarehttpsLocally, behind Traefik v3.5: same results for the classic and native worker modes, and no value carried over between two worker requests from different clients.
Not changed by this PR: with
trusted_proxies: '127.0.0.1,REMOTE_ADDR'(Apache and FrankenPHP alike), Symfony trusts the visitor and takes a spoofedX-Forwarded-Port: 8443into generated URLs (https://labs.silarhi.fr:8443), reproduced through Cloudflare. The README now says not to use it;scan4all/API-Wow,airbus/video-creator.airbus.comandeleo/trainingdo locally.Not tested: IPv6 visitors (no IPv6 on the test machine); the Cloudflare v6 ranges are in the trusted list.
The README section is appended after "Image Variants Explained", like #59's Configuration section: whichever merges second needs a trivial rebase.