How to set the HTTPS server variable?

[kohenkatz]

The default trusted proxy configuration uses the client_ip_headers option to set the remote address directly in the request, instead of requiring the client application to handle trusted proxies. PHP then sees this in the $_SERVER['REMOTE_ADDR'] value.

However, this configuration does not handle the other X-Forwarded-... headers. Specifically, the X-Forwarded-Proto header does not get translated to the $_SERVER['HTTPS'] superglobal.

This means that frameworks such as Laravel and Symfony cannot detect whether the request came from HTTPS or not. (Without client_ip_headers, these frameworks can use their own Trusted Proxy middleware to set these values, but with it, they never see the proxy address.)

Here is what Symfony's isSecure looks like (which Laravel also uses):

    /**
     * Checks whether the request is secure or not.
     *
     * This method can read the client protocol from the "X-Forwarded-Proto" header
     * when trusted proxies were set via "setTrustedProxies()".
     *
     * The "X-Forwarded-Proto" header must contain the protocol: "https" or "http".
     */
    public function isSecure(): bool
    {
        if ($this->isFromTrustedProxy() && $proto = $this->getTrustedValues(self::HEADER_X_FORWARDED_PROTO)) {
            return \in_array(strtolower($proto[0]), ['https', 'on', 'ssl', '1'], true);
        }

        $https = $this->server->get('HTTPS');

        return $https && (!\is_string($https) || 'off' !== strtolower($https));
    }

Is there any way to configure FrankenPHP to set HTTPS if X-Forwarded-Proto is set to https?

---

I know that it's technically possible to work around this (as noted in the documentation) by setting Laravel's trusted proxies to *, but that seems like a hack -- it's not that we are "trusting all proxies", it's actually that "we are pretending not to use any proxies"...

[Dv2Corn]

Yes. FrankenPHP's env accepts placeholders; this image already uses env REMOTE_ADDR {client_ip} in its php_server block. So you can set HTTPS from a variable that is only filled in when it's safe. I tested this with serversideup/php:8.4-frankenphp (FrankenPHP 1.13.4, Caddy 2.11.7).

1. Add /etc/frankenphp/caddyfile-server.d/https-from-proxy.caddyfile. That directory is imported into your site block:

   # HTTPS=on when the request itself is TLS, or when a trusted proxy says it was
   @https_request {
   	protocol https
   }
   @forwarded_https {
   	remote_ip private_ranges
   	header X-Forwarded-Proto https
   }
   vars @https_request is_https on
   vars @forwarded_https is_https on

2. Pass it into PHP:

   CADDY_PHP_SERVER_OPTIONS=env HTTPS {http.vars.is_https}
   

Results with TRUSTED_PROXY=local:

request	$_SERVER['HTTPS']	REMOTE_ADDR
from proxy, X-Forwarded-Proto: https, X-Forwarded-For: 203.0.113.7	on	203.0.113.7
from proxy, X-Forwarded-Proto: http	""	proxy IP
plain HTTP, no header	""	client IP
direct TLS (SSL_MODE=full)	on	client IP

Notes:

• The protocol https rule is needed. Without it, env HTTPS {…} overrides FrankenPHP's own value with an empty string, and direct TLS requests lose HTTPS=on. I hit exactly that in the first attempt.
• The remote_ip check means only your proxy can switch it on, so a client can't fake it by sending the header directly. Use the same ranges as your trusted_proxies (private_ranges matches the local preset; for Cloudflare, list their ranges).
• An empty HTTPS counts as "not secure" in Symfony's isSecure() ($https && …), and so in Laravel too, so you don't need to change Laravel's trusted proxies.

[kohenkatz]

Thank you for your help! This works for me.

I also opened php/frankenphp#2800 and then caddyserver/caddy#8338 to discuss further.