Skip to content

Default TrustedHeaderNames are not standard... are they? #17641

@xDaizu

Description

@xDaizu

This directly references SymfonyDocs #6197, where I originally posted it by mistake.


In this section, the documentation states:

By default, the following proxy headers are trusted:

X-Forwarded-For Used in getClientIp();
X-Forwarded-Host Used in getHost();
X-Forwarded-Port Used in getPort();
X-Forwarded-Proto Used in getScheme() and isSecure();

I want to make clear that I'm not a proxy expert, but as I understand it, those headers are not standard. They're common (pseudo-standard) but not standard since the RFC 7239 was released in 2014

My points are:

  1. Does it support the standard Forwarded header by default and all its attributes? This is an actual question, as I can't try it right now. If not, it should. Because standards. Standards are cool.
  2. In the same line, I put up to debate if it should support the pseudo-standard headers by default. Is it useful? Yes, it is; but it can be argued that it fights against the extension of the standard, which I think is a burden mid-long term, because people (especially devs, especially me) are lazy and standards are cool and dandy but the path of least resistance is even cooler; and when the standard is not the path of least resistence for the majority, the very concept of standard becomes useless... and that makes me sad 😢

TL;DR; You're not gonna read it? Then you're either a _a)_lazy or a _b)_busy person. Case a)C'mon, I made it fun and easy to read. Case b) I will probably waste your time. This is not the urgent issue you're looking for

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions