Configuring Trusted Proxies for PHP Applications

Only known reverse proxy IPs may supply forwarded-client-IP and scheme headers.

What It Does and When to Use It

Only accept forwarded IP headers from known proxy peers; production chains need a reviewed trust policy. Direct PHP code exposes the underlying operation clearly; a framework can supply lifecycle hooks, dependency wiring and retries.

Requirements, Inputs and Expected Behavior

Confirm the runtime, extension, environment variables, and permissions before running the examples in production. Never trust X-Forwarded-For from arbitrary Internet clients.

Example 1: Basic Operation

Only accept forwarded IP headers from known proxy peers; production chains need a reviewed trust policy.

<?php
$trusted = ['10.0.0.15', '10.0.0.16'];
 $peer = $_SERVER['REMOTE_ADDR'] ?? '';
 $ip = $peer;
 if (in_array($peer, $trusted, true)) {
     $parts = explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'] ?? '');
     $candidate = trim($parts[0] ?? '');
     if (filter_var($candidate, FILTER_VALIDATE_IP)) $ip = $candidate;
 }
 echo $ip;

Example 2: Behavior and Validation

Evaluate forwarded protocol only at a trusted reverse-proxy boundary.

<?php
$trusted = ['192.0.2.10'];
 $peer = $_SERVER['REMOTE_ADDR'] ?? '';
 $isHttps = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off');
 if (in_array($peer, $trusted, true)) {
     $proto = strtolower(trim($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? ''));
     if (in_array($proto, ['http', 'https'], true)) $isHttps = $proto === 'https';
 }
 var_dump($isHttps);

Practical Example: Application Use

Configure proxy headers upstream and restrict direct access to the application.

location / {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_pass http://php_frontend;
}

Important Behavior and Edge Cases

The second example highlights: Evaluate forwarded protocol only at a trusted reverse-proxy boundary. The practical example adds: Configure proxy headers upstream and restrict direct access to the application.

Comparison with Related Approaches

Common Beginner Mistakes

Key Takeaways

• Only known reverse proxy IPs may supply forwarded-client-IP and scheme headers.
• Configure proxy headers upstream and restrict direct access to the application.
• Choose based on deployment requirements and verify actual behavior rather than assuming defaults.