From aac8e3cec62d0d97427a56d44fc7c246d74887d7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Somogyi=20M=C3=A1rton?= Date: Sun, 6 Oct 2019 13:58:33 +0200 Subject: [PATCH] Already resolved IP: doc added #17521 (#17596) [skip ci] --- docs/guide/runtime-requests.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/docs/guide/runtime-requests.md b/docs/guide/runtime-requests.md index 8a648b2f83..888323228f 100644 --- a/docs/guide/runtime-requests.md +++ b/docs/guide/runtime-requests.md @@ -200,3 +200,23 @@ With the above configuration, all headers listed in `secureHeaders` are filtered except the `X-ProxyUser-Ip` and `Front-End-Https` headers in case the request is made by the proxy. In that case the former is used to retrieve the user IP as configured in `ipHeaders` and the latter will be used to determine the result of [[yii\web\Request::getIsSecureConnection()]]. + +### Already resolved user IP + +If the user's IP address is resolved before the Yii application (e.g. `ngx_http_realip_module` or similar), +the `request` component will work correctly with the following configuration: + +```php +'request' => [ + // ... + 'trustedHosts' => [ + '0.0.0.0/0', + ], + 'ipHeaders' => [], +], +``` + +In this case, the value of [[yii\web\Request::userIP|userIP]] will be equal to `$_SERVER['REMOTE_ADDR']`. +Also, properties that are resolved from HTTP headers will work correctly (e.g. [[yii\web\Request:: getIsSecureConnection()]]. + +> Warning: The `trustedHosts=['0.0.0.0/0']` setting assumes that all IPs are trusted.