diff --git a/deployment/proxies.rst b/deployment/proxies.rst index fc6f855451d..cd5649d979a 100644 --- a/deployment/proxies.rst +++ b/deployment/proxies.rst @@ -22,7 +22,11 @@ Solution: ``setTrustedProxies()`` --------------------------------- To fix this, you need to tell Symfony which reverse proxy IP addresses to trust -and what headers your reverse proxy uses to send information: +and what headers your reverse proxy uses to send information. + +You can do that by setting the ``SYMFONY_TRUSTED_PROXIES`` and ``SYMFONY_TRUSTED_HEADERS`` +environment variables on your machine. Alternatively, you can configure them +using the following configuration options: .. configuration-block:: @@ -93,6 +97,11 @@ and what headers your reverse proxy uses to send information: ``private_ranges`` as a shortcut for private IP address ranges for the ``trusted_proxies`` option was introduced in Symfony 7.1. +.. versionadded:: 7.2 + + Support for the ``SYMFONY_TRUSTED_PROXIES`` and ``SYMFONY_TRUSTED_HEADERS`` + environment variables was introduced in Symfony 7.2. + .. caution:: Enabling the ``Request::HEADER_X_FORWARDED_HOST`` option exposes the diff --git a/reference/configuration/framework.rst b/reference/configuration/framework.rst index 19f72bb6cb3..53edf220642 100644 --- a/reference/configuration/framework.rst +++ b/reference/configuration/framework.rst @@ -198,7 +198,12 @@ named ``kernel.http_method_override``. trust_x_sendfile_type_header ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -**type**: ``boolean`` **default**: ``false`` +**type**: ``boolean`` **default**: ``%env(bool:default::SYMFONY_TRUST_X_SENDFILE_TYPE_HEADER)%`` + +.. versionadded:: 7.2 + + In Symfony 7.2, the default value of this option was changed from ``false`` to the + value stored in the ``SYMFONY_TRUST_X_SENDFILE_TYPE_HEADER`` environment variable. ``X-Sendfile`` is a special HTTP header that tells web servers to replace the response contents by the file that is defined in that header. This improves @@ -450,7 +455,12 @@ in debug mode. trusted_hosts ~~~~~~~~~~~~~ -**type**: ``array`` | ``string`` **default**: ``[]`` +**type**: ``array`` | ``string`` **default**: ``['%env(default::SYMFONY_TRUSTED_HOSTS)%']`` + +.. versionadded:: 7.2 + + In Symfony 7.2, the default value of this option was changed from ``[]`` to the + value stored in the ``SYMFONY_TRUSTED_HOSTS`` environment variable. A lot of different attacks have been discovered relying on inconsistencies in handling the ``Host`` header by various software (web servers, reverse