Can you explain the use case where it is important to determine if the request came from a trusted proxy? This method is already used in several places in the Request class. So maybe it would be more reasonable if you called one the other methods of the Request class.

I'm using this to determine whether to trust a custom X-Base-Url header that's added by our Vagrant reverse proxy setup. It's a nonstandard header, so I think none of the existing methods are sufficient to extract it.

More concretely, we have a small middleware plugin for Laravel which sets the root URL for the application:

class ProxiedBaseUrlMiddleware
{
    public function handle($request, Closure $next)
    {
        $request = CustomRequest::createFromBase($request);
        $baseUrl = $request->maybeGetProxiedBaseUrl();
        if ($baseUrl) \URL::forceRootUrl($baseUrl);
        return $next($request);
    }
}

And CustomRequest looks like this:

class CustomRequest extends IlluminateRequest
{
    public function maybeGetProxiedBaseUrl()
    {
        $isFromTrustedProxy = self::$trustedProxies && IpUtils::checkIp($this->server->get('REMOTE_ADDR'), self::$trustedProxies);
        /* $this->isFromTrustedProxy() is private... */
        if ($isFromTrustedProxy) return $this->headers->get('X-Base-Url');
        else return null;
    }
}

Here, IlluminateRequest is Laravel's Request class which extends from Symfony's. If the Request class would expose isFromTrustedProxy(), we could move the check to our middleware and get rid of the custom subclass as well as the creation of another Request object with the createFromBase() method (though this latter part is a shortcoming of Laravel's dependency injection, not a problem with Symfony).

A slightly longer explanation can be found in my blog post about how we're using this plugin.

👍

👍

Status: Reviewed

Thank you @sjamaan.