Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Possible fix for proxy/reverse proxy #14896

Merged
merged 1 commit into from
Jun 19, 2024
Merged

Possible fix for proxy/reverse proxy #14896

merged 1 commit into from
Jun 19, 2024

Conversation

snipe
Copy link
Owner

@snipe snipe commented Jun 18, 2024

This should override Symfony's parsing of URLs to prevent folks from having to add the APP_FORCE_TLS=true to their .env when they are running behind a proxy/reverse proxy. I'm still not 100% sure why this change was needed when it wasn't in previous versions, but I think this will fix the issue.

This will still let you force override (for whatever possible reason) if your URL schema is not https (which you definitely shouldn't do, in general), but it basically changes things so that if you state your APP_URL to be https://, we WILL enforce secure urls.

Many thanks to @uberbrady and all of the amazing folks in the PHP Portugal Telegram group for helping us rubberduck this.

rubber-ducking

Copy link

what-the-diff bot commented Jun 18, 2024

PR Summary

  • Enabling Support for URL Facade
    A code statement has been added to include URL Facade which acts as a helper tool to generate URLs.

  • Enforcing HTTPS Scheme
    Within the 'boot' function, we have instituted a check. The purpose is to ensure that HTTPS, a more secure version of the HTTP protocol, is enforced whenever the application URL starts with 'https://' or if a specific setting (APP_FORCE_TLS) is enabled.

  • Preventing URL Forgery via Host Headers
    Again, in the 'boot' function, a precautionary measure was added to prevent the potential manipulation of URL's through the Host headers. However, this restriction can be overridden if another setting (APP_ALLOW_INSECURE_HOSTS) is activated. This is to ensure a secure communication, by maintaining the integrity of data across the webpages.

@snipe snipe merged commit d8eccf0 into develop Jun 19, 2024
8 checks passed
@snipe snipe deleted the fixes/tls_loading branch June 19, 2024 09:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant