php/yii2
1
0
Fork 0
mirror of https://github.com/yiisoft/yii2.git synced 2025-11-01 11:39:41 +08:00
Code Issues Packages Projects Releases Wiki Activity

#17733: Additional fixes for #17665, Forwarded header parsing in Request

Browse Source 
- Remove header from secure headers
- Regexp and return null fix
- Fix tests, fix in array case sensitivity, rx duplicated group name
- Simplify code
- Add phpdoc

Co-Authored-By: Alexander Makarov <sam@rmcreative.ru>
This commit is contained in:
Somogyi Márton
2019-12-17 19:53:55 +01:00
committed by Alexander Makarov
parent 62acca9f3d
commit 5e71b11d8d
4 changed files with 71 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/guide/runtime-requests.md
View File

@ -201,6 +201,10 @@ except the `X-ProxyUser-Ip` and `Front-End-Https` headers in case the request is
In that case the former is used to retrieve the user IP as configured in `ipHeaders` and the latter
will be used to determine the result of [[yii\web\Request::getIsSecureConnection()]].
Since 2.0.31 [RFC 7239](https://tools.ietf.org/html/rfc7239) `Forwarded` header is supported. In order to enable
it you need to add header name to `secureHeaders`. Make sure your proxy is setting it, otherwise end user would be
able to spoof IP and protocol.
### Already resolved user IP <span id="already-respolved-user-ip"></span>
If the user's IP address is resolved before the Yii application (e.g. `ngx_http_realip_module` or similar),