jdavidbakr / cloudfrontproxies Goto Github PK

This is really helpful (we had the same problem for a project of ours), do you mind taking contacts to the TrustedProxy maintainer, which is discussing similar problems (fideloper/TrustedProxy#108), and try to merge the packages in a way which allows custom headers in general, with shortcuts for more common setups?

Hello @jdavidbakr

Thanks for writing this package.

Looking at the code I've noticed the HEADER_X_FORWARDED_ALL is hard coded into the middleware. Is this required for the package to work?

Would it be better to follow a similar pattern to Fidelopers Trusted Proxy middleware to set the constant in a class variable which then the user can extend and overwrite according to their needs.

I've also seen that Symfony are deprecating the HEADER_X_FORWARDED_ALL in version 5.2 of their HTTP package

Happy to create a PR if you broadly agree?

readme.md implies that you only need to enable this code in your Laravel middleware configuration, but you also have to configure CloudFront to actually set Cloudfront-Forwarded-Proto (in Behaviours - Whitelist headers). It doesn't set it by default, and then the middleware doesn't detect the request as coming from Cloudfront.

In my case I don't need X-Forwarded-Proto to be set properly, as I'm using https everywhere. I think it would be better to test for X-Amz-Cf-Id to be sure it's a Cloudfront request than to look for Cloudfront-Forwarded-Proto.

Either way the doc should mention that you have to manually set up this header.

Thanks for the code!