Nginx ngx_http_realip_module when enabled breaks trusted reverse proxy

[marfillaster]

Q	A
Bug report?	yes
Symfony version	all

Request::isFromTrustedProxy relies on REMOTE_ADDR header to check against trusted proxies. Nginx replaces the header with the actual client ip when ngx_http_realip_module is enabled.

I think it should be documented to not use this nginx module for now.

Workaround

# proxied nginx config

map $http_x_forwarded_host $X_REMOTE_ADDR {
   # no available trusted variable holding the proxy ip. 
  ~.+ <proxy server ip>;
  default $remote_addr;
}

set_real_ip_from <proxy server ip>;
real_ip_header X-Forwarded-For;
real_ip_recursive on;

server {
#...
  location @php {
     fastcgi_param REMOTE_ADDR $X_REMOTE_ADDR;
  }
#...
}

[htuscher]

Would be nice if there would be a workaround for Symfony.

This gets very complex if you have something like Cloudflare -> Traefik (SSL Terminated) -> Nginx -> Symfony.

Isn't it possible to do something like in combination with the realip module:

$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_FORWARDED_FOR'];

$request = Request::createFromGlobals();
$response = $kernel->handle($request);

[stof]

You should indeed not use ngx_http_realip_module when using trusted proxies, as this nginx module precisely tries to hide the nginx proxy to allow for apps not having such concept of trusted proxies (which then is not able to deal with cases where we have multiple layers of trusted proxies).

[htuscher]

Thanks for the clarification. That should make it into the docs ;-)

[carsonbot]

Thank you for this issue.
There has not been a lot of activity here for a while. Has this been resolved?

[carsonbot]

Could I get an answer? If I do not hear anything I will assume this issue is resolved or abandoned. Please get back to me <3

[xabbuh]

closing in favor of symfony/symfony-docs#14718