Skip to content

Implemented RFC 7239 - "Forwarded HTTP Extension" #94

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Jun 17, 2016
Merged

Implemented RFC 7239 - "Forwarded HTTP Extension" #94

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
ec85d5d
Implemented RFC 7239 - " Forwarded HTTP Extension" handling in Reques…
patrickkusebauch May 21, 2016
61e9275
Implemented RFC 7239 - " Forwarded HTTP Extension" handling in Reques…
patrickkusebauch May 21, 2016
a6e205c
Deleted echo statement
patrickkusebauch May 21, 2016
44660bd
case- insensitive handling of tokens
patrickkusebauch May 22, 2016
11461e6
Proper handle of quoted strings.
patrickkusebauch May 22, 2016
17d3397
Tests refactoring:
patrickkusebauch May 22, 2016
a2c7a79
Code simplifications
patrickkusebauch May 22, 2016
2383979
Fixed coding standards for tests
patrickkusebauch May 22, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
72 changes: 53 additions & 19 deletions src/Http/RequestFactory.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -194,30 +194,64 @@ public function createHttpRequest()
$usingTrustedProxy = $remoteAddr && array_filter($this->proxies, function ($proxy) use ($remoteAddr) {
return Helpers::ipMatch($remoteAddr, $proxy);
});

if ($usingTrustedProxy) {
if (!empty($_SERVER['HTTP_X_FORWARDED_PROTO'])) {
$url->setScheme(strcasecmp($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') === 0 ? 'https' : 'http');
}
if(!empty($_SERVER['HTTP_FORWARDED'])) {
$forwardParams = preg_split('/[,;]/', $_SERVER['HTTP_FORWARDED']);
foreach ($forwardParams as $forwardParam) {
list($key, $value) = explode('=', $forwardParam, 2) + [1 => NULL];
$proxyParams[strtolower(trim($key))][] = trim($value, " \t\"");
}
Copy link
Contributor

@JanTvrdik JanTvrdik May 22, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This can be simplified to

foreach ($forwardParams as $forwardParam) {
    list($key, $value) = explode('=', $forwardParam, 2) + [1 => NULL];
    $proxyParams[strtolower(trim($key))] = trim($value, " \t\"");
}

Copy link
Contributor Author

@patrickkusebauch patrickkusebauch May 22, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Integrated in commit a2c7a79


if (!empty($_SERVER['HTTP_X_FORWARDED_PORT'])) {
$url->setPort((int) $_SERVER['HTTP_X_FORWARDED_PORT']);
}
if(isset($proxyParams['for'])) {
$address = $proxyParams['for'][0];
if(strpos($address, '[') === FALSE) { //IPv4
$remoteAddr = explode(':', $address)[0];
} else { //IPv6
$remoteAddr = substr($address, 1, strpos($address, ']')-1);
}
}

if(isset($proxyParams['host']) && count($proxyParams['host']) === 1) {
$host = $proxyParams['host'][0];
$startingDelimiterPosition = strpos($host, '[');
if($startingDelimiterPosition === FALSE) { //IPv4
$remoteHostArr = explode(':', $host);
$remoteHost = $remoteHostArr[0];
if(isset($remoteHostArr[1])) $url->setPort((int) $remoteHostArr[1]);
} else { //IPv6
$endingDelimiterPosition = strpos($host, ']');
$remoteHost = substr($host, strpos($host, '[')+1, $endingDelimiterPosition-1);
$remoteHostArr = explode(':', substr($host, $endingDelimiterPosition));
if(isset($remoteHostArr[1])) $url->setPort((int) $remoteHostArr[1]);
}
}

$scheme = (isset($proxyParams['scheme']) && count($proxyParams['scheme']) === 1) ? $proxyParams['scheme'][0] : 'http';
$url->setScheme(strcasecmp($scheme, 'https') === 0 ? 'https' : 'http');
} else {
if (!empty($_SERVER['HTTP_X_FORWARDED_PROTO'])) {
$url->setScheme(strcasecmp($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') === 0 ? 'https' : 'http');
}

if (!empty($_SERVER['HTTP_X_FORWARDED_PORT'])) {
$url->setPort((int) $_SERVER['HTTP_X_FORWARDED_PORT']);
}

if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
$xForwardedForWithoutProxies = array_filter(explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']), function ($ip) {
return !array_filter($this->proxies, function ($proxy) use ($ip) {
return Helpers::ipMatch(trim($ip), $proxy);
if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
$xForwardedForWithoutProxies = array_filter(explode(',', $_SERVER['HTTP_X_FORWARDED_FOR']), function ($ip) {
return !array_filter($this->proxies, function ($proxy) use ($ip) {
return Helpers::ipMatch(trim($ip), $proxy);
});
});
});
$remoteAddr = trim(end($xForwardedForWithoutProxies));
$xForwardedForRealIpKey = key($xForwardedForWithoutProxies);
}
$remoteAddr = trim(end($xForwardedForWithoutProxies));
$xForwardedForRealIpKey = key($xForwardedForWithoutProxies);
}

if (isset($xForwardedForRealIpKey) && !empty($_SERVER['HTTP_X_FORWARDED_HOST'])) {
$xForwardedHost = explode(',', $_SERVER['HTTP_X_FORWARDED_HOST']);
if (isset($xForwardedHost[$xForwardedForRealIpKey])) {
$remoteHost = trim($xForwardedHost[$xForwardedForRealIpKey]);
if (isset($xForwardedForRealIpKey) && !empty($_SERVER['HTTP_X_FORWARDED_HOST'])) {
$xForwardedHost = explode(',', $_SERVER['HTTP_X_FORWARDED_HOST']);
if (isset($xForwardedHost[$xForwardedForRealIpKey])) {
$remoteHost = trim($xForwardedHost[$xForwardedForRealIpKey]);
}
}
}
}
Expand Down
95 changes: 95 additions & 0 deletions tests/Http/RequestFactory.proxy.forwarded.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,95 @@
<?php

/**
* Test: Nette\Http\RequestFactory and proxy with "Forwarded" header.
*/

use Nette\Http\RequestFactory;
use Tester\Assert;


require __DIR__ . '/../bootstrap.php';

test(function () {
$_SERVER = [
'REMOTE_ADDR' => '127.0.0.3',
'REMOTE_HOST' => 'localhost',
'HTTP_FORWARDED' => 'for=23.75.45.200;host=192.168.0.1',
];

$factory = new RequestFactory;
$factory->setProxy('127.0.0.1');
Assert::same('127.0.0.3', $factory->createHttpRequest()->getRemoteAddress());
Assert::same('localhost', $factory->createHttpRequest()->getRemoteHost());

$factory->setProxy('127.0.0.1/8');
Assert::same('23.75.45.200', $factory->createHttpRequest()->getRemoteAddress());
Assert::same('192.168.0.1', $factory->createHttpRequest()->getRemoteHost());

$url = $factory->createHttpRequest()->getUrl();
Assert::same('http', $url->getScheme());
});

test(function () {
$_SERVER = [
'REMOTE_ADDR' => '127.0.0.3',
'REMOTE_HOST' => 'localhost',
'HTTP_FORWARDED' => 'for=23.75.45.200:8080;host=192.168.0.1:8080',
];

$factory = new RequestFactory;

$factory->setProxy('127.0.0.3');
Assert::same('23.75.45.200', $factory->createHttpRequest()->getRemoteAddress());
Assert::same('192.168.0.1', $factory->createHttpRequest()->getRemoteHost());

$url = $factory->createHttpRequest()->getUrl();
Assert::same(8080, $url->getPort());
});


test(function () {
$_SERVER = [
'REMOTE_ADDR' => '127.0.0.3',
'REMOTE_HOST' => 'localhost',
'HTTP_FORWARDED' => 'for="[2001:db8:cafe::17]";host="[2001:db8:cafe::18]"',
];

$factory = new RequestFactory;

$factory->setProxy('127.0.0.3');
Assert::same('2001:db8:cafe::17', $factory->createHttpRequest()->getRemoteAddress());
Assert::same('2001:db8:cafe::18', $factory->createHttpRequest()->getRemoteHost());
});

test(function () {
$_SERVER = [
'REMOTE_ADDR' => '127.0.0.3',
'REMOTE_HOST' => 'localhost',
'HTTP_FORWARDED' => 'for="[2001:db8:cafe::17]:47831";host="[2001:db8:cafe::18]:47832"',
];

$factory = new RequestFactory;

$factory->setProxy('127.0.0.3');
Assert::same('2001:db8:cafe::17', $factory->createHttpRequest()->getRemoteAddress());
Assert::same('2001:db8:cafe::18', $factory->createHttpRequest()->getRemoteHost());

$url = $factory->createHttpRequest()->getUrl();
Assert::same(47832, $url->getPort());
});


test(function () {
$_SERVER = [
'REMOTE_ADDR' => '127.0.0.3',
'REMOTE_HOST' => 'localhost',
'HTTP_FORWARDED' => 'for="[2001:db8:cafe::17]:47831" ; host="[2001:db8:cafe::18]:47832" ; scheme=https',
];

$factory = new RequestFactory;
$factory->setProxy('127.0.0.3');

$url = $factory->createHttpRequest()->getUrl();
Assert::same('https', $url->getScheme());
});
2 changes: 1 addition & 1 deletion tests/Http/RequestFactory.proxy.phpt → ...ttp/RequestFactory.proxy.x-forwarded.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
<?php

/**
* Test: Nette\Http\RequestFactory and proxy.
* Test: Nette\Http\RequestFactory and proxy with "X-forwarded" headers.
*/

use Nette\Http\RequestFactory;
Expand Down