Laravel selects a wrong IP on Trusted Proxies

I'm using caddy as a webserver and laravel octane to supercharge my app

and here's my trust proxies settings $middleware->trustProxies(at: '*', headers: Request::HEADER_X_FORWARDED_FOR);

and here's the $request->header() values

'x-forwarded-for' => array ( 0 => '1.1.1.1, 8.8.8.8', ),

the 1.1.1. is the client ip and 8.8.8.8 is the cdn ip the problem is when I use $request->ip() I get 8.8.8.8 instead of 1.1.1.1 how can I fix that ?

Level 50

that is weird, what is the output for $request->ips()?

the ip() method is just a wrapper for symfonys getClientIp()` https://github.com/symfony/symfony/blob/7.2/src/Symfony/Component/HttpFoundation/Request.php#L751 which returns first from the array. i didnt look further, but if it doesnt make any magic with the headers "array", it should really return the first one...

Level 3

@s4muel Thank you for your response

Here's the $request->ips() output : array ( 0 => '8.8.8.8' (cdn ip ), 1 => '1.1.1.1' (client/user ip), )

Which is really weird why would the cdn ip get the first in the array ? based on this header 'x-forwarded-for' => array ( 0 => '1.1.1.1, 8.8.8.8', ),

If you had any idea I would appreciate the help

Best Answer

Level 3

OK Found the solution You have to put your CDN IPs in the $middleware->trustProxies(at: 192.168.1./24', headers: Request::HEADER_X_FORWARDED_FOR);

otherwise it wouldn't count them as safe and would ignore them

Please or to participate in this conversation.