$request->ip() doesnt work behind Cloudflare

[EnelKyss]

$request->ip() always return invalid IP address when the server is using cloudflare proxy.
there should be something like this:

if (isset($_SERVER["HTTP_CF_CONNECTING_IP"])) {
        $_SERVER['REMOTE_ADDR'] = $_SERVER["HTTP_CF_CONNECTING_IP"];
        $_SERVER['HTTP_CLIENT_IP'] = $_SERVER["HTTP_CF_CONNECTING_IP"];
}

[ghost]

Put this on construct for \App\Http\Middleware\TrustProxies

public function __construct()
{
    $proxies = \explode(',', '0.0.0.0/0,::/0');

    if (\is_array($proxies) && \count($proxies) > 0) {
        $this->proxies = $proxies;
    }
}

Or declare them in the class param directly
protected $proxies = ['0.0.0.0/0', '::/0'];

This will allow all proxies by the way.

[EnelKyss]

Is that safe ? I feel like TrustProxies.php is there for a reason.

[ghost]

When you are using proxies and you need to get the client ip, you need to instruct laravel to trust your proxies (if you know their ip address).

[Fludem]

Cloudflare also has two headers it applies to the requests

CF-Connecting-IP << This is the clients IP
and X-Forwarded-For << This is the clients IP if it wasn't in place before the request reached cloudflare

So you can also use this document that gives you their IP addresses so you can trust only their proxies if you want to tighten up security, on top of that you can block traffic that hasn't come via cloudflare:

https://developers.cloudflare.com/fundamentals/concepts/cloudflare-ip-addresses/