trusted proxies are incompatible with nginx realip module

[stof]

See the discussion in symfony/symfony#26006

The doc should mention that the nginx realip module should not be used when wanting to use trusted proxies (the effect of this module is to partially hide the fact that the request went through a proxy, which then breaks things when you rely on features for which it was not sufficient).

[patpilus]

@stof does it also affect apache's mod_remoteip, which seems to work in similar way?
https://httpd.apache.org/docs/2.4/mod/mod_remoteip.html

[stof]

@patpilus I would say yes.

Note that the apache module seems to have its own config for trusted proxies, so mod_remoteip should be able to resolve the right IP for the case of multiple layers of trusted proxies. But this still wouldn't solve the support for other X-Forwarded-* headers as mod_remoteip only cares about the X-Forwarded-For header containing IP addresses (and it does not support the newer standard for Forwarded either and so won't work if that's what your proxy uses, even though most proxy servers seem to keep using the older X-Forwarded-* de-facto standard).

[patpilus]

Indeed, mod_remoteip tries to resolve the real client IP based on its own trusted proxies list and replaces the value of REMOTE_ADDR with the first untrusted one. If all proxies from X-Forwarded-For header are trusted then the header itself is removed.

With mod_remoteip enabled, $request->isFromTrustedProxy() https://github.com/symfony/http-foundation/blob/5.2/Request.php#L2048 will always return false, because REMOTE_ADDR is not proxy IP anymore.

I'm supposing that setting TRUSTED_PROXIES env var to to eg. 127.0.0.1,REMOTE_ADDR as stated in documentation: https://symfony.com/doc/current/deployment/proxies.html#but-what-if-the-ip-of-my-reverse-proxy-changes-constantly may work as a workaround (of course after ensuring that traffic will only be allowed from trusted reverse proxies).

Should something else be adjusted to have mod_remoteip enabled when Symfony app is behind Load Balancer/Reverse Proxy or shouldn't we use mod_remoteip at all?

[stof]

@patpilus if you only care about $request->getClientIp(), resolving them at the Symfony level or at the mod_remoteip works equally fine. You should not do both. That does not make sense. If you use mod_remoteip, the list of trusted proxies at the symfony level should be empty as REMOTE_ADDR should precisely not be considered as a trusted proxy anymore (as that will be the untrusted IP rather than the IP of the trusted proxy after mod_remoteip applies its logic).

The issue with resolving the trusted proxy in Apache rather than in Symfony comes from other places using $request->isFromTrustedProxy() to support the other X-Forwarded-* headers. If you have such needs (to properly detect a forwarded protocol in case the proxy is the one terminating TLS for instance and then forwarding to Apache using unencrypted connection), you will need to keep the handling in Symfony, so that Symfony can see the fact that some proxies are involved (mod_remoteip is meant to hide that fact from the app, allowing to access the IP as if no proxy was involved, but that limits it to basic cases).

My own recommendation would be to not use mod_remoteip at all.

[patpilus]

@stof, thanks for the detailed answer! Our goal of resolving client IP at webserver level is to have it stored correctly in Apache access logs as well as ModSecurity ones. Unfortunately using just %{X-Forwarded-For}i is not perfect for this purpose, because it can be a collection of IPs if the request went through more proxies, eg. (data is anonymised):

{"channel": "access_log", "time":"[17/Jan/2021:10:01:23 +0000]", "remoteIP": 17.12.11.202, 23.192.218.102", (...)}

We decided to use mod_remoteip as /etc/apache2/apache2.conf (from debian buster) says:

# Note that the use of %{X-Forwarded-For}i instead of %h is not recommended.
# Use mod_remoteip instead.

After setting SetEnvIf X-Forwarded-Proto "https" HTTPS=on in apache, our Symfony application, which works behind AWS Elastic Load Balancer, seems to behave correctly. I've debugged return values from all HttpFoundation\Request functions which are relying on isFromTrustedProxy() one and it looks good from what I see, although I understand it would be better to resolve them from X-Forwarded-* headers.

Do you think that we can expect any other side effects from Symfony if we decide to go forward with mod_remoteip anyway?