How to Configure Symfony to Work behind a Load Balancer or a Reverse Proxy

Solution: setTrustedProxies()

To fix this, you need to tell Symfony which reverse proxy IP addresses to trust and what headers your reverse proxy uses to send information:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

// public/index.php

// ...
$request = Request::createFromGlobals();

// tell Symfony about your reverse proxy
Request::setTrustedProxies(
    // the IP address (or range) of your proxy
    ['192.0.0.1', '10.0.0.0/8'],

    // trust *all* "X-Forwarded-*" headers
    Request::HEADER_X_FORWARDED_ALL

    // or, if your proxy instead uses the "Forwarded" header
    // Request::HEADER_FORWARDED

    // or, if you're using AWS ELB
    // Request::HEADER_X_FORWARDED_AWS_ELB
);

The Request object has several Request::HEADER_* constants that control exactly which headers from your reverse proxy are trusted. The argument is a bit field, so you can also pass your own value (e.g. 0b00110).

But what if the IP of my Reverse Proxy Changes Constantly!

Some reverse proxies (like AWS Elastic Load Balancing) don't have a static IP address or even a range that you can target with the CIDR notation. In this case, you'll need to - very carefully - trust all proxies.

1. Configure your web server(s) to not respond to traffic from any clients other than your load balancers. For AWS, this can be done with security groups.

2. Once you've guaranteed that traffic will only come from your trusted reverse proxies, configure Symfony to always trust incoming request:

   1
   2
   3
   4
   5
   6
   7
   8
   9
   10
   11

   // public/index.php
   
   // ...
   Request::setTrustedProxies(
       // trust *all* requests (the 'REMOTE_ADDR' string is replaced at
       // run time by $_SERVER['REMOTE_ADDR'])
       ['127.0.0.1', 'REMOTE_ADDR'],
   
       // if you're using ELB, otherwise use a constant from above
       Request::HEADER_X_FORWARDED_AWS_ELB
   );

That's it! It's critical that you prevent traffic from all non-trusted sources. If you allow outside traffic, they could "spoof" their true IP address and other information.

1
2

# .env
TRUSTED_PROXIES=127.0.0.1,REMOTE_ADDR

If you are also using a reverse proxy on top of your load balancer (e.g. CloudFront), calling $request->server->get('REMOTE_ADDR') won't be enough, as it will only trust the node sitting directly above your application (in this case your load balancer). You also need to append the IP addresses or ranges of any additional proxy (e.g. CloudFront IP ranges) to the array of trusted proxies.

Custom Headers When Using a Reverse Proxy

Some reverse proxies (like CloudFront with CloudFront-Forwarded-Proto) may force you to use a custom header. For instance you have Custom-Forwarded-Proto instead of X-Forwarded-Proto.

In this case, you'll need to set the header X-Forwarded-Proto with the value of Custom-Forwarded-Proto early enough in your application, i.e. before handling the request:

1
2
3
4
5
6

// public/index.php

// ...
$_SERVER['HTTP_X_FORWARDED_PROTO'] = $_SERVER['HTTP_CUSTOM_FORWARDED_PROTO'];
// ...
$response = $kernel->handle($request);