Skip to content

tweaks to the new reverse proxy/load balancer chapter #4113

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Aug 15, 2014
Merged

tweaks to the new reverse proxy/load balancer chapter #4113

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
12840b1
improve linking between proxy config sections
xabbuh Aug 10, 2014
6943da8
fix a headline
xabbuh Aug 10, 2014
bbc2f11
fix code block
xabbuh Aug 10, 2014
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion book/http_cache.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,7 +163,7 @@ The caching kernel will immediately act as a reverse proxy - caching responses
from your application and returning them to the client.

Now that you're using a "proxy", you'll need to configure ``127.0.0.1`` under
the ``trusted_proxies`` configuration (see :ref:`reference <reference-framework-trusted-proxies>`).
the ``trusted_proxies`` configuration (see :ref:`the reference <reference-framework-trusted-proxies>`).
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not using framework.trusted_proxies as I first proposed here makes sense since the option name is already mentioned before in this sentence.

Without this, the client's IP address and a few other things won't report correctly.

.. tip::
Expand Down
19 changes: 10 additions & 9 deletions cookbook/request/load_balancer_reverse_proxy.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
How to Configure Symfony to Work behind a Load Balancer or Reverse Proxy
========================================================================
How to Configure Symfony to Work behind a Load Balancer or a Reverse Proxy
==========================================================================

When you deploy your application, you may be behind a load balancer (e.g.
an AWS Elastic Load Balancer) or a reverse proxy (e.g. Varnish for
Expand Down Expand Up @@ -60,7 +60,8 @@ and which reverse proxy IP addresses will be doing this type of thing:

In this example, you're saying that your reverse proxy (or proxies) has
the IP address ``192.0.0.1`` or matches the range of IP addresses that use
the CIDR notation ``10.0.0.0/8``. For more details, see :ref:`reference-framework-trusted-proxies`.
the CIDR notation ``10.0.0.0/8``. For more details, see the
:ref:`framework.trusted_proxies <reference-framework-trusted-proxies>` option.

That's it! Symfony will now look for the correct ``X-Forwarded-*`` headers
to get information like the client's IP address, host, port and whether or
Expand All @@ -80,13 +81,13 @@ In this case, you'll need to - *very carefully* - trust *all* proxies.
proxies, configure Symfony to *always* trust incoming request. This is
done inside of your front controller::

// web/app.php
// ...
// web/app.php

Request::setTrustedProxies(array($request->server->get('REMOTE_ADDR')));
// ...
Request::setTrustedProxies(array($request->server->get('REMOTE_ADDR')));

$response = $kernel->handle($request);
// ...
$response = $kernel->handle($request);
// ...

That's it! It's critical that you prevent traffic from all non-trusted sources.
If you allow outside traffic, they could "spoof" their true IP address and
Expand All @@ -97,7 +98,7 @@ My Reverse Proxy Uses Non-Standard (not X-Forwarded) Headers

Most reverse proxies store information on specific ``X-Forwarded-*`` headers.
But if your reverse proxy uses non-standard header names, you can configure
these (:doc:`see reference </components/http_foundation/trusting_proxies>`.
these (see ":doc:`/components/http_foundation/trusting_proxies`").
The code for doing this will need to live in your front controller (e.g. ``web/app.php``).

.. _`security groups`: http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/using-elb-security-groups.html