[8.x] Implement TrustProxies middleware

[driesvints]

This PR ports the TrustedProxies package by Chris Fidao to Laravel. This will help us reduce one more external dependency we used to rely on.

In contrary to the original package, all configuration is done through overwriting properties. I'll send in an additional PR to laravel/laravel after this is merged and tagged.

[GrahamCampbell]

Why must this be abstract?

[driesvints]

@GrahamCampbell TrustHosts is also abstract. We extend the middleware in the skeleton.

[GrahamCampbell]

A common thing i like to do is delete middlewares from the skeleton and use the default. Less app code to worry about and upgrade later.

[driesvints]

Done

[taylorotwell]

Will this have any breaking changes?

[driesvints]

@taylorotwell no. It's an entire new class.

[rrpadilla]

@driesvints The $headers should accept "int|string|null"

    /**
     * The proxy header mappings.
     *
     * @var int|string|null
     */
    protected $headers = Request::HEADER_X_FORWARDED_FOR | Request::HEADER_X_FORWARDED_HOST | Request::HEADER_X_FORWARDED_PORT | Request::HEADER_X_FORWARDED_PROTO | Request::HEADER_X_FORWARDED_AWS_ELB;

As you can see in the "getTrustedHeaderNames()" function.

   /**
     * Retrieve trusted header name(s), falling back to defaults if config not set.
     *
     * @return int A bit field of Request::HEADER_*, to set which headers to trust from your proxies.
     */
    protected function getTrustedHeaderNames()
    {
        switch ($this->headers) {
            case 'HEADER_X_FORWARDED_AWS_ELB':
            case Request::HEADER_X_FORWARDED_AWS_ELB:
                return Request::HEADER_X_FORWARDED_AWS_ELB;

            case 'HEADER_FORWARDED':
            case Request::HEADER_FORWARDED:
                return Request::HEADER_FORWARDED;

            case 'HEADER_X_FORWARDED_FOR':
            case Request::HEADER_X_FORWARDED_FOR:
                return Request::HEADER_X_FORWARDED_FOR;

            case 'HEADER_X_FORWARDED_HOST':
            case Request::HEADER_X_FORWARDED_HOST:
                return Request::HEADER_X_FORWARDED_HOST;

            case 'HEADER_X_FORWARDED_PORT':
            case Request::HEADER_X_FORWARDED_PORT:
                return Request::HEADER_X_FORWARDED_PORT;

            case 'HEADER_X_FORWARDED_PROTO':
            case Request::HEADER_X_FORWARDED_PROTO:
                return Request::HEADER_X_FORWARDED_PROTO;

            default:
                return Request::HEADER_X_FORWARDED_FOR | Request::HEADER_X_FORWARDED_HOST | Request::HEADER_X_FORWARDED_PORT | Request::HEADER_X_FORWARDED_PROTO | Request::HEADER_X_FORWARDED_AWS_ELB;
        }

        return $this->headers;
    }

This is very useful when we need to get the $headers and $proxies from a config file. For example if the site is hosted on AWS behind AWS Elastic Load Balancer.

<?php

namespace App\Http\Middleware;

use Illuminate\Http\Middleware\TrustProxies as Middleware;
use Illuminate\Http\Request;
use Illuminate\Contracts\Config\Repository;

class TrustProxies extends Middleware
{
    /**
     * The trusted proxies for this application.
     *
     * @var array|string|null
     */
    protected $proxies;

    /**
     * The headers that should be used to detect proxies.
     *
     * @var int
     */
    protected $headers;

    /**
     * Create a new trusted proxies middleware instance.
     *
     * @param  \Illuminate\Contracts\Config\Repository  $config
     * @return void
     */
    public function __construct(Repository $config)
    {
        $this->proxies = $config->get('trustedproxy.proxies');
        $this->headers = $config->get('trustedproxy.headers');
    }
}

The "config/trustedproxy.php" file

<?php

return [

    'proxies' => env('TRUSTEDPROXY_PROXIES'),

    'headers' => env('TRUSTEDPROXY_HEADERS', 'HEADER_X_FORWARDED_AWS_ELB'),

];

Will be great if we can add this to the Laravel documentation.

Thanks.

[driesvints]

@rrpadilla the current type seems correct to me.

[rrpadilla]

@driesvints
keep in mind that the $headers attribute is used as a mapping to get the trusted header value, it is not the final header.
The function getTrustedHeaderNames() will return the trusted header to use based on the $headers attribute.
That type (@var null|string|int) is exactly what the TrustedProxies package by Chris Fidao is using because you can use a string value that you get from the config file.

[ttrig]

I suspect this might be a breaking change since the possibility to configure this middleware with the trustedproxy.proxies config option was left out.

https://github.com/fideloper/TrustedProxy/blob/master/src/TrustProxies.php#L67

[driesvints]

There's no breaking change. This is a new middleware to the framework.