TrustedProxies final readonly class
Minn\Http\TrustedProxies · public/minn/src/Minn/Http/TrustedProxies.php · 115 lines
Which addresses in front of the engine may speak for the client.
By default none do: a forwarded header is a request header, and a request header is the client's word. Behind a proxy or CDN that terminates TLS, `REMOTE_ADDR` is then the proxy's, which makes every visitor look like one address (the sign-in throttle would lock them all out together) and every request look insecure (the auth cookie would lose its Secure flag).
A site says who to believe in `wp-config.php`:
define('MINN_TRUSTED_PROXIES', '10.0.0.0/8, 2400:cb00::/32'); define('MINN_TRUSTED_PROXIES', '*'); // any: only when nothing but the proxy can reach PHP
The client is then the right-most address in `X-Forwarded-For` that is not itself trusted, which is what a proxy chain appends, so a client that sends its own `X-Forwarded-For` cannot put an address the engine believes to the right of the proxy's. `*` trusts whoever connects, not every forwarded hop: the client is the address that proxy appended (with it every hop, the client's own included, would be skipped as trusted, and every visitor would be the proxy again).
Constants and properties
| private | readonly array $ranges | Promoted from the constructor. |
Public
| new | __construct(array $ranges)# |
| |||
| static | none(): self# | Nobody in front of the engine speaks for the client. | |||
| static | configured(): self# | What the site declared in wp-config.php, or nobody. | |||
| method | trusts(string $address): bool# | Whether the engine believes what this address says about the client. | |||
| method | clientAddress(string $remoteAddress, string $forwardedFor): string# | The client's address, given who connected and what was forwarded: the right-most forwarded address that is not itself a trusted proxy. | |||
| method | forwardedSecure(string $remoteAddress, string $forwardedProto): bool# | Whether a forwarded scheme may be believed, and says https. |
Internals 3
Private and protected methods: how the class does its work. Not a contract; they change whenever the code is tidied.
| private | coversHop(string $hop): bool# | Whether a forwarded hop is a trusted proxy: one a declared range covers (`*` speaks for the connecting address only). |
| private | bare(string $value): string# | An address with a port or brackets stripped, as a forwarded list may carry them. |
| private | covers(string $range, string $address): bool# | Whether a CIDR range or a plain address covers the address given. |
Nothing matches.