erichard/cloudfront-proxies-bundle

Trusts the AWS Cloudfront proxies IP in your Symfony projects

1.0.0 2021-12-16 13:47 UTC

Requires

• symfony/framework-bundle: ^4.4.0 || ^5.0
• symfony/http-client: ^4.4.0 || ^5.0

Requires (Dev)

• phpspec/prophecy-phpunit: ^2.0

MIT

• Erwan Richard

README

The bundle automatically register all Cloudfront IP range to the list of the trusted proxies.

The IP range is downloaded from AWS : https://ip-ranges.amazonaws.com/ip-ranges.json

These IPs are cached for one hour by default.

Configuration

Check the default configuration below.

# config/packages/erichard_cloudfront_proxies.yaml

erichard_cloudfront_proxies:
  expire: 3600
  cache: cache.app
  ip_range_url: https://ip-ranges.amazonaws.com/ip-ranges.json

Note

The IP list is only downloaded when the request contains a Cloudfront-Forwarded-Proto header. According to the AWS documentation this header is not sent by default so you need to configure your Cloudfront distribution properly.

The bundle also take care of setting back the X-Forwarded-Proto header based on Cloudfront-Forwarded-Proto.