From what I can tell the reverse_proxy settings are not wired up yet. Attached is a patch that uses them in DrupalKernel::initializeRequestGlobals().

It is just adding the small snippet below:

      // Initialize proxy settings.
      if (Settings::get('reverse_proxy', FALSE)) {
        $proxies = Settings::get('reverse_proxy_addresses', array());
        if (count($proxies) > 0) {
          Request::setTrustedProxies($proxies);
        }
      }
CommentFileSizeAuthor
DrupalKernel.php_.patch839 bytesjudahtanthony

Comments

dawehner’s picture

Issue tags: +Needs tests

See \Drupal\Core\EventSubscriber\ReverseProxySubscriber ... so are you sure that we need this?

Maybe we do have to adapt the priority of this listener or actually implement it with stackphp.
Given that this is a bug we should consider to write a test, if it really does not work.

judahtanthony’s picture

The reason I put it here was because you have to know that you are behind a proxy before you call $request->isSecure() as the proxy can terminate the SSL connection, and just passes on a header to flag it as a secure connection. $request->isSecure() correctly looks for the header, but it needs to be informed first.

alexpott’s picture

Title: Initialize proxy inform with reverse_proxy and reverse_proxy_addresses » Ensure trusted proxies are set before calling Request::isSecure()
Issue tags: +Needs issue summary update

Nice find.

dawehner’s picture

Issue tags: +stackphp

Just a random example where a stack based approach could help.

dawehner’s picture

Status: Active » Postponed
dawehner’s picture

Status: Postponed » Fixed

Yeah one less critical!!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.