Installation
Laravel 5.5+ comes with this package. If you are using Laravel 5.5 or greater, you do not need to add this to your project separately.
Laravel 5.0 - 5.4
To install Trusted Proxy, use:
composer require fideloper/proxy:^3.3
Setup
Add the Service Provider:
'providers' => array(
# other providers omitted
'Fideloper\Proxy\TrustedProxyServiceProvider',
);
Publish the package config file to config/trustedproxy.php:
$ php artisan vendor:publish --provider="Fideloper\Proxy\TrustedProxyServiceProvider"
Register the HTTP Middleware in file app/Http/Kernel.php:
protected $middleware = [
// Illuminate middlewares omitted for brevity
'Fideloper\Proxy\TrustProxies',
Then edit the published configuration file config/trustedproxy.php as needed.
The below will trust a proxy, such as a load balancer or web cache, at IP address 192.168.10.10:
<?php
return [
'proxies' => [
'192.168.10.10',
],
// These are defaults already set in the config:
'headers' => [
(defined('Illuminate\Http\Request::HEADER_FORWARDED') ? Illuminate\Http\Request::HEADER_FORWARDED : 'forwarded') => 'FORWARDED',
\Illuminate\Http\Request::HEADER_CLIENT_IP => 'X_FORWARDED_FOR',
\Illuminate\Http\Request::HEADER_CLIENT_HOST => 'X_FORWARDED_HOST',
\Illuminate\Http\Request::HEADER_CLIENT_PROTO => 'X_FORWARDED_PROTO',
\Illuminate\Http\Request::HEADER_CLIENT_PORT => 'X_FORWARDED_PORT',
]
];
Note: If you're using AWS Elastic Load Balancing or Heroku, the FORWARDED and X_FORWARDED_HOST headers should be set to null as they are currently unsupported there.
<?php
return [
'proxies' => [
'192.168.10.10',
],
// These are defaults already set in the config:
'headers' => [
(defined('Illuminate\Http\Request::HEADER_FORWARDED') ? Illuminate\Http\Request::HEADER_FORWARDED : 'forwarded') => null,
\Illuminate\Http\Request::HEADER_CLIENT_IP => 'X_FORWARDED_FOR',
\Illuminate\Http\Request::HEADER_CLIENT_HOST => null,
\Illuminate\Http\Request::HEADER_CLIENT_PROTO => 'X_FORWARDED_PROTO',
\Illuminate\Http\Request::HEADER_CLIENT_PORT => 'X_FORWARDED_PORT',
]
];
Trusted Proxy in Laravel 5.5+
Laravel 5.5 comes with the TrustedProxy package which does this for us (you can pull it into your older Laravel projects if you're not on 5.5).
When Laravel 5.5 is released, it will auto-load the service provider. For now, we need to update config/app.php to add the Fideloper\Proxy\TrustedProxyServiceProvider item.
We simply setup the configuration:
php artisan vendor:publish
Once we create the config/trustedproxy.php file, we can set our load balancer as trusted.
return [
'proxies' => [
'172.31.10.88',
],
# Some other things omitted
];
And then we can set the IP address of our trusted proxy (the load balancer) is using.
Or we can use a wildcard if we won't know the IP address, which is the case when using a load balancer service such as ELB, ALB, Linode's equivalent and others.
Once that's set, we should see Laravel work correctly!
