TrustedHeaderNames are not standard

[xDaizu]

The default proxy Headers

Request::setTrustedHeaderName(Request::HEADER_CLIENT_IP, 'X-Proxy-For');
Request::setTrustedHeaderName(Request::HEADER_CLIENT_HOST, 'X-Proxy-Host');
Request::setTrustedHeaderName(Request::HEADER_CLIENT_PORT, 'X-Proxy-Port');
Request::setTrustedHeaderName(Request::HEADER_CLIENT_PROTO, 'X-Proxy-Proto');

don't follow the standard RFC 7239 (although it seems barely anyone does). Wouldn't it be nice to do it?

[xabbuh]

I am not sure if I understand your issue. The sentence before this code example reads like this:

If your reverse proxy uses a different header name for any of these, you can configure that header name via setTrustedHeaderName(): [...]

So it's clear that you only need this when your proxy does not use one of the default headers, isn't it?

[xDaizu]

No, what I meant (I might be wrong) is that it looks like the header that Symfony expects, by default, is "X-Proxy-For", which is a common way of specifying the IP the proxy is redirecting to, but not the RFC standard way (which is a "Forwarded" header with a "for" attribute).

[xabbuh]

I don't see what part of the docs did make you think that. Would you mind proposing how to change the documentation to make this more clear?

[xDaizu]

http://symfony.com/doc/current/components/http_foundation/trusting_proxies.html#configuring-header-names

This states:

By default, the following proxy headers are trusted:

X-Forwarded-For Used in getClientIp();
X-Forwarded-Host Used in getHost();
X-Forwarded-Port Used in getPort();
X-Forwarded-Proto Used in getScheme() and isSecure();

My point is those headers are not standard. They're common (pseudo-standard) but not standard since the RFC 7239 was released in 2014, which is the one I linked in my original post.

It is not about what the Symfony2 documentation states, but about how Symfony2 behaves by default.

Does it support the standard Forwarded header by default and all its attributes? This is an actual question, as I can't try it right now. If not, it should.

In the same line, I put up to debate if it should support the pseudo-standard headers by default. Is it useful? Yes, it is; but it can be argued that it fights against the extension of the standard, which I think is a burden mid-long term.

[xabbuh]

Hm, so if I understand you correctly, you want to discuss whether or not it is worth to change the code. If that's the case, you should rather open an issue in the code repository.

[xDaizu]

@xabbuh OOPS, sorry, my bad! 😭

[xabbuh]

closing in favour of symfony/symfony#17641