You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[13.x] Document the trustedproxy.proxies configuration fallback for trusted proxies
#62165
The Configuring Trusted Proxies section only explains how to set trusted proxies with $middleware->trustProxies(at: ...) in bootstrap/app.php.
It does not mention that Illuminate\Http\Middleware\TrustProxies falls back to the trustedproxy.proxies configuration value when no proxies were set that way:
This fallback was restored in #41322 ("like back in the days when we had Fideloper's package"), but it was never documented. An earlier docs PR, laravel/docs#7457, was closed without being merged.
Why it should be documented
Proxy addresses usually differ between environments: none locally, a load balancer subnet in staging and production. The withMiddleware callback in bootstrap/app.php runs before the environment and configuration are loaded. Because of that, config() cannot be used there, and env() returns null for values from .env (see [11.x] Add trustedproxy config file to allow dynamic assignment for IPs #52085). Unlike trustHosts(), trustProxies(at:) does not accept a closure.
The configuration fallback is the only built-in way to set trusted proxies per environment, and it works with config:cache.
#### Configuring Trusted Proxies via Configuration
If you do not specify trusted proxies using the `trustProxies` method,
the `TrustProxies` middleware will use the `trustedproxy.proxies`
configuration value instead. This is useful when your trusted proxies
differ between environments, since configuration values are not yet
available when `bootstrap/app.php` is evaluated. To get started, create
a `config/trustedproxy.php` configuration file:
<?phpreturn [ 'proxies' => env('TRUSTED_PROXIES'),];
The value may be `*`, an array of IP addresses or CIDR ranges, or a
comma-separated string:
TRUSTED_PROXIES=192.168.1.1,10.0.0.0/8
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
The Configuring Trusted Proxies section only explains how to set trusted proxies with
$middleware->trustProxies(at: ...)inbootstrap/app.php.It does not mention that
Illuminate\Http\Middleware\TrustProxiesfalls back to thetrustedproxy.proxiesconfiguration value when no proxies were set that way:framework/src/Illuminate/Http/Middleware/TrustProxies.php
Line 69 in 1de9acf
This fallback was restored in #41322 ("like back in the days when we had Fideloper's package"), but it was never documented. An earlier docs PR, laravel/docs#7457, was closed without being merged.
Why it should be documented
withMiddlewarecallback inbootstrap/app.phpruns before the environment and configuration are loaded. Because of that,config()cannot be used there, andenv()returnsnullfor values from.env(see [11.x] Add trustedproxy config file to allow dynamic assignment for IPs #52085). UnliketrustHosts(),trustProxies(at:)does not accept a closure.config:cache.Proposed addition
After "Trusting All Proxies" in requests.md:
All reactions