From 6779a2759ec806e619ccae603955df120d0c4808 Mon Sep 17 00:00:00 2001 From: Chris Fidao Date: Tue, 19 Dec 2017 06:48:46 -0600 Subject: [PATCH 1/2] Trusted proxy to version 4.0 for laravel 5.6 --- app/Http/Middleware/TrustProxies.php | 10 ++-------- composer.json | 2 +- 2 files changed, 3 insertions(+), 9 deletions(-) diff --git a/app/Http/Middleware/TrustProxies.php b/app/Http/Middleware/TrustProxies.php index ef1c00d1..a97254ea 100644 --- a/app/Http/Middleware/TrustProxies.php +++ b/app/Http/Middleware/TrustProxies.php @@ -15,15 +15,9 @@ class TrustProxies extends Middleware protected $proxies; /** - * The current proxy header mappings. + * The headers used to detect proxies. * * @var array */ - protected $headers = [ - Request::HEADER_FORWARDED => 'FORWARDED', - Request::HEADER_X_FORWARDED_FOR => 'X_FORWARDED_FOR', - Request::HEADER_X_FORWARDED_HOST => 'X_FORWARDED_HOST', - Request::HEADER_X_FORWARDED_PORT => 'X_FORWARDED_PORT', - Request::HEADER_X_FORWARDED_PROTO => 'X_FORWARDED_PROTO', - ]; + protected $headers = Request::HEADER_X_FORWARDED_FOR; } diff --git a/composer.json b/composer.json index b18c2ffc..cd966f82 100644 --- a/composer.json +++ b/composer.json @@ -6,7 +6,7 @@ "type": "project", "require": { "php": ">=7.1.0", - "fideloper/proxy": "~3.3", + "fideloper/proxy": "~4.0", "laravel/framework": "5.6.*", "laravel/tinker": "~1.0" }, From e8237953252adff5aac9f19b98cc224c11a3b5dc Mon Sep 17 00:00:00 2001 From: Chris Fidao Date: Tue, 19 Dec 2017 06:52:00 -0600 Subject: [PATCH 2/2] using correct header to use "ALL" x-forwarded-* headers --- app/Http/Middleware/TrustProxies.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/Http/Middleware/TrustProxies.php b/app/Http/Middleware/TrustProxies.php index a97254ea..d6da3b99 100644 --- a/app/Http/Middleware/TrustProxies.php +++ b/app/Http/Middleware/TrustProxies.php @@ -19,5 +19,5 @@ class TrustProxies extends Middleware * * @var array */ - protected $headers = Request::HEADER_X_FORWARDED_FOR; + protected $headers = Request::HEADER_X_FORWARDED_ALL; }