ecphp / reverse-proxy-helper-bundle
Helper bundle, configure the request headers from a given base URL.
Installs: 4 793
Dependents: 0
Suggesters: 0
Security: 0
Stars: 0
Watchers: 2
Forks: 1
Open Issues: 2
Type:symfony-bundle
Requires
- php: >= 7.2.5
- ext-filter: *
- symfony/framework-bundle: ^5.2.4
Requires (Dev)
- ecphp/php-conventions: ^1
- friends-of-phpspec/phpspec-code-coverage: ^6.1
- infection/infection: ^0.23
- infection/phpspec-adapter: ^0.1.1
- phpspec/phpspec: ^7
- symfony/http-kernel: ^5.2.4
This package is auto-updated.
Last update: 2024-10-10 03:30:39 UTC
README
Reverse Proxy Helper Bundle
At European Commission, many applications are behind a reverse proxy server.
If the reverse proxy configuration is not properly set, Symfony applications will generate invalid URIs because they will use their internal server URIs instead of the one given by the reverse proxy.
For some reason, the reverse proxy services at European Commission doesn't send all the necessary headers to let Symfony generate proper URIs.
This bundle will make sure that the URIs are properly generated by providing the missing headers and set the appropriate trusted proxies configuration.
Requirements
- PHP >= 7.2.5
- Symfony >= 5.2.4
Installation
composer require ecphp/reverse-proxy-helper-bundle
Then, in your Symfony application, create a new configuration file reverse-proxy-helper.yaml
in config/packages
:
reverse_proxy_helper: base_url: https://frontend-url-foobar:12345/app1/
You may also move this file in a specific environment if needed, and modulate the configuration based on the environment.
You can also use environment variables as well:
Update your configuration file as such to use an environment variable REVERSE_PROXY_URL
:
reverse_proxy_helper: base_url: '%env(resolve:REVERSE_PROXY_URL)%'
You also need to configure the trusted_headers
and trusted_proxies
in framework.yaml
, example:
framework: trusted_proxies: '127.0.0.1,REMOTE_ADDR' trusted_headers: ['x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-forwarded-port', 'x-forwarded-prefix']
What does this do?
This bundle ensures that proper headers are set for HTTP requests behind a reverse proxy.
Setting a trusted proxy and proper headers allows for correct URL generation, redirecting, session handling and logging in Symfony when behind a reverse proxy.
This is useful if your web servers sit behind a load balancer (Nginx, HAProxy, Envoy, ELB/ALB, etc), HTTP cache (CloudFlare, Squid, Varnish, etc), or other intermediary (reverse) proxy.
Why does this matter?
A very common load balancing approach is to send https://
requests to a load balancer, but send http://
requests to the application servers behind the load balancer.
For example, you may send a request in your browser to https://example.org
. The load balancer, in turn, might send requests to an application server at http://192.168.1.23
.
What if that server returns a redirect, or generates an asset url? The users's browser would get back a redirect or HTML that includes http://192.168.1.23
in it, which is clearly wrong.
What happens is that the application thinks its hostname is 192.168.1.23
and the schema is http://
. It doesn't know that the end client used https://example.org
for its web request.
So the application needs to know to read the X-Forwarded
headers to get the correct request details
(schema https://
, host example.org
).
Symfony is able to reads those headers, but only if the trusted proxy configuration is correctly set to "trust" the load balancer/reverse proxy.
How does this work?
Applications behind a reverse proxy typically read some HTTP headers such as X-Forwarded-*
, (X-Forwarded-For
, X-Forwarded-Proto
, X-Forwared-Host
, X-Forwarded-Port
, X-Forwarded-Prefix
)
to know about the real end-client making an HTTP request.
If those headers were not set, then the application code would think every incoming HTTP request would be from the proxy.
The Symfony HTTP base classes have a concept of a "trusted proxy", where those X-Forwarded-*
headers will only be used if the source IP address of the request is known.
This package creates an easier interface to that option. You can set the IP addresses of the proxies
(that the application would see, so it may be a private network IP address), and Symfony will use
the X-Forwarded-*
headers if an HTTP request containing those headers was from the trusted proxy.
Open Source contributions
- symfony/framework-bundle: #40281