diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Log potential redirect loops caused by forced HTTPS

Browse Source 
If the developer forgets/fails to set "trusted_proxies" properly, forcing the
https channel can cause infinite redirect loops. This change will hopefully
help them identify the problem faster.

See https://github.com/symfony/symfony/issues/27603
This commit is contained in:
Colin O'Dell 2018-06-19 10:59:18 -04:00
parent b560883ffe
commit 53048cec6d
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/Symfony/Component/Security/Http/Firewall/ChannelListener.php
View File

@ -46,7 +46,13 @@ class ChannelListener implements ListenerInterface
if ('https' === $channel && !$request->isSecure()) {
if (null !== $this->logger) {
$this->logger->info('Redirecting to HTTPS.');
if ('https' === $request->headers->get('X-Forwarded-Proto')) {
$this->logger->info('Redirecting to HTTPS. ("X-Forwarded-Proto" header is set to "https" - did you set "trusted_proxies" correctly?)');
} elseif (false !== strpos($request->headers->get('Forwarded'), 'proto=https')) {
$this->logger->info('Redirecting to HTTPS. ("Forwarded" header is set to "proto=https" - did you set "trusted_proxies" correctly?)');
} else {
$this->logger->info('Redirecting to HTTPS.');
}
}
$response = $this->authenticationEntryPoint->start($request);