Skip to content

Commit

Permalink
docs: update RFC 7239 link (#18839)
Browse files Browse the repository at this point in the history
fix #18838
  • Loading branch information
githubjeka committed Aug 16, 2021
1 parent b7943c6 commit df6e586
Show file tree
Hide file tree
Showing 3 changed files with 3 additions and 3 deletions.
2 changes: 1 addition & 1 deletion docs/guide-ja/runtime-requests.md
Original file line number Diff line number Diff line change
Expand Up @@ -201,7 +201,7 @@ Yii アプリケーションに渡されるからです。
その場合、前者は `ipHeaders` で構成されているようにユーザの IP を読み出すために使用され、
後者は [[yii\web\Request::getIsSecureConnection()]] の結果を決定するために使用されます。

2.0.31 以降、[RFC 7239](https://tools.ietf.org/html/rfc7239)`Forwarded` ヘッダがサポートされています。
2.0.31 以降、[RFC 7239](https://datatracker.ietf.org/doc/html/rfc7239)`Forwarded` ヘッダがサポートされています。
有効にするためには、ヘッダ名を `secureHeaders` に追加する必要があります。
あなたのプロキシにそれを設定させることを忘れないで下さい。さもないと、エンド・ユーザが IP とプロトコルを盗み見ることが可能になります。

Expand Down
2 changes: 1 addition & 1 deletion docs/guide/runtime-requests.md
Original file line number Diff line number Diff line change
Expand Up @@ -201,7 +201,7 @@ except the `X-ProxyUser-Ip` and `Front-End-Https` headers in case the request is
In that case the former is used to retrieve the user IP as configured in `ipHeaders` and the latter
will be used to determine the result of [[yii\web\Request::getIsSecureConnection()]].

Since 2.0.31 [RFC 7239](https://tools.ietf.org/html/rfc7239) `Forwarded` header is supported. In order to enable
Since 2.0.31 [RFC 7239](https://datatracker.ietf.org/doc/html/rfc7239) `Forwarded` header is supported. In order to enable
it you need to add header name to `secureHeaders`. Make sure your proxy is setting it, otherwise end user would be
able to spoof IP and protocol.

Expand Down
2 changes: 1 addition & 1 deletion framework/web/Request.php
Original file line number Diff line number Diff line change
Expand Up @@ -218,7 +218,7 @@ class Request extends \yii\base\Request
* If the list contains the `Forwarded` header, processing will be done according to RFC 7239.
* The match of header names is case-insensitive.
* @see https://en.wikipedia.org/wiki/List_of_HTTP_header_fields
* @see https://tools.ietf.org/html/rfc7239
* @see https://datatracker.ietf.org/doc/html/rfc7239
* @see $trustedHosts
* @since 2.0.13
*/
Expand Down

0 comments on commit df6e586

Please sign in to comment.