Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[Security] Not possible to restrict ESI routes to only the Symfony 2 reverse proxy. #6982

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
bendavies opened this issue Feb 6, 2013 · 5 comments
Closed

[Security] Not possible to restrict ESI routes to only the Symfony 2 reverse proxy. #6982

bendavies opened this issue Feb 6, 2013 · 5 comments

Comments

@bendavies
Copy link
Contributor

Ref: http://symfony.com/doc/current/book/security.html#securing-by-ip

the ESI route must be secured to be only visible from the trusted reverse proxy cache.

This is not possible if using the Symfony 2 Reverse proxy.

If you are implementing a situation exactly as in the above link, you cannot limit ESI calls to only be accessible to the S2 reverse proxy.

When making the ESI request, the client IP of the of the ESI request that Symfony2 formulates is the same as the original master request for the parent page. i.e the original client's IP address.
@bamarni
Copy link
Contributor

bamarni commented Feb 6, 2013

Oh I think it's a quite annoying bug, this means HttpCache is currently broken, I can see some code in here : https://github.com/symfony/symfony/blob/master/src/Symfony/Component/HttpKernel/EventListener/FragmentListener.php#L73

Which IIUC throws a 403 when the client requesting a fragment (such an esi) isn't on the same machine or on the trusted IPs list.

You can't see the bug when you develop because usually your webserver is localhost.

IMO HttpCache should act as a real reverse proxy, switch REMOTE_ADDR to 127.0.0.1 and add the real one to the X_Forwarded_For chain.

This was referenced Feb 7, 2013
Closed
Closed
@bamarni
Copy link
Contributor

bamarni commented Feb 8, 2013

This should be tagged as critical and 2.2 blocker.

@bendavies
Copy link
Contributor Author

@fabpot any thoughts?

@fabpot fabpot mentioned this issue Feb 9, 2013
Closed
@fabpot
Copy link
Member

fabpot commented Feb 9, 2013

I've just submitted a PR to fix that issue, see #7034

fabpot added a commit to fabpot/symfony that referenced this issue Feb 11, 2013
@fabpot
[HttpKernel] added support for the X-Forwarded-For header (closes sym…
1fdded5 
…fony#6982, closes symfony#7000)
fabpot added a commit that referenced this issue Feb 11, 2013
@fabpot
added support for the X-Forwarded-For header (closes #6982, closes #7000
42d3c4c 
)
fabpot added a commit that referenced this issue Feb 11, 2013
@fabpot
merged branch fabpot/ip-cache (PR #7034)
22e997a 
This PR was submitted for the 2.2 branch but it was merged into the 2.1 branch instead (closes #7034).

Commits
-------

1fdded5 [HttpKernel] added support for the X-Forwarded-For header (closes #6982, closes #7000)
be65d7c [HttpKernel] fixed the IP address in HttpCache when calling the backend

Discussion
----------

Make HttpCache behaves more like a real reverse proxy

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | #6982, #7000
| License       | MIT
| Doc PR        | n/a

---------------------------------------------------------------------------

by bendavies at 2013-02-10T00:55:29Z

Awesome, thanks Fabien. should this not target 2.0/2.1?
@fabpot fabpot closed this as completed Feb 11, 2013
@bendavies
Copy link
Contributor Author

wonderful!

fabpot added a commit that referenced this issue Feb 11, 2013
@fabpot
Merge branch '2.1' into 2.2
743612b 
* 2.1:
  added support for the X-Forwarded-For header (closes #6982, closes #7000)
  fixed the IP address in HttpCache when calling the backend
  [EventDispatcher] Added assertion.
  [EventDispathcer] Fix removeListener
  [DependencyInjection] Add clone for resources which were introduced in 2.1
  [DependencyInjection] Allow frozen containers to be dumped to graphviz
  Fix 'undefined index' error, when entering scope recursively
  [Security] fixed session creation on login (closes #7011)
  Add dot character `.` to legal mime subtype regular expression
  [HttpFoundation] fixed the creation of sub-requests under some circumstancies (closes #6923, closes #6936)
fabpot added a commit that referenced this issue Feb 11, 2013
@fabpot
Merge branch '2.2'
f66e109 
* 2.2:
  Fixed XmlFileLoaderTest::testLoadThrowsExceptionWithInvalidFileEvenWithoutSchemaValidation
  moved file hash calculation to own method
  [Validator] Add check for existing metadata on property
  added support for the X-Forwarded-For header (closes #6982, closes #7000)
  fixed the IP address in HttpCache when calling the backend
  [EventDispatcher] Added assertion.
  [EventDispathcer] Fix removeListener
  [DependencyInjection] Add clone for resources which were introduced in 2.1
  [DependencyInjection] Allow frozen containers to be dumped to graphviz
  Fix 'undefined index' error, when entering scope recursively
  [Security] fixed session creation on login (closes #7011)
  replaced usage of the deprecated pattern routing key (replaced with path)
  Add dot character `.` to legal mime subtype regular expression
  [HttpFoundation] fixed the creation of sub-requests under some circumstancies (closes #6923, closes #6936)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@fabpot @bendavies @bamarni