File tree 1 file changed +9
-3
lines changed
1 file changed +9
-3
lines changed Original file line number Diff line number Diff line change @@ -40,16 +40,22 @@ and what headers your reverse proxy uses to send information::
40
40
// or, if your proxy instead uses the "Forwarded" header
41
41
// Request::HEADER_FORWARDED
42
42
43
- // or, if you're using a wellknown proxy
43
+ // or, if you're using a well-known proxy
44
44
// Request::HEADER_X_FORWARDED_AWS_ELB
45
45
// Request::HEADER_X_FORWARDED_TRAEFIK
46
46
);
47
47
48
+ .. deprecated :: 5.2
49
+
50
+ In previous Symfony versions, the above example used ``HEADER_X_FORWARDED_ALL ``
51
+ to trust all "X-Forwarded-*" headers, but that constant is deprecated since
52
+ Symfony 5.2 in favor of the individual ``HEADER_X_FORWARDED_*`` constants.
53
+
48
54
.. caution ::
49
55
50
56
Enabling the ``Request::HEADER_X_FORWARDED_HOST `` option exposes the
51
- application to " `HTTP Host header attacks `_" . Make sure the proxy really
52
- send a ``x-forwarded-host `` header.
57
+ application to `HTTP Host header attacks `_. Make sure the proxy really
58
+ sends an ``x-forwarded-host `` header.
53
59
54
60
The Request object has several ``Request::HEADER_* `` constants that control exactly
55
61
*which * headers from your reverse proxy are trusted. The argument is a bit field,
You can’t perform that action at this time.
0 commit comments