Should I trust all proxies?

I have a problem understanding TrustProxies.php

By default, I let it

protected $proxies;

but I now want to use

sail share

to expose my app only on dev env so the docs tell me to do this:

protected $proxies = '*'

As far as I understand, won't this create a security risk for my app? Or am I misunderstanding of how proxies work?

LaryAI

2 years ago

Level 58

The $proxies property in Laravel's TrustProxies middleware is used to specify which proxies the application should trust when determining the client's IP address. By default, it is set to an empty array, which means that the application will only trust the client's IP address as reported by the web server.

If you set $proxies to '*', it means that the application will trust any proxy that is in front of it. This can be a security risk if you are not sure who is sending requests to your application through the proxy.

If you are using sail share to expose your app only on the dev environment, you can set $proxies to the IP address range used by Docker for the sail network. This will ensure that the application only trusts requests coming from the sail network.

Here's an example of how you can set $proxies in your App\Http\Middleware\TrustProxies middleware:

protected $proxies = [
    '172.16.0.0/12', // Docker IP range for sail network
];

This will ensure that the application only trusts requests coming from the 172.16.0.0/12 IP range, which is used by Docker for the sail network.

Note that you should always be careful when trusting proxies, as it can be a security risk if not done properly.

1 like

catalin12

2 years ago

Level 2

@LaryAI as this is an important question about the security of my app, can I know where you got your sources from?

martinbean

2 years ago

Level 80

@catalin12

This reply was automagically generated by our local A.I. Think of it as a one-off attempt to instantly solve your problem. It will not respond to further replies.

Please or to participate in this conversation.