Update Request.zep - Githubissues

phalcon / cphalcon

High performance, full-stack PHP framework delivered as a C extension.

https://phalcon.io

BSD 3-Clause "New" or "Revised" License

10.79k stars 1.96k forks source link

Update Request.zep #16639

Open zikezhang opened 2 months ago

zikezhang commented 2 months ago

enhance getScheme() function.

Hello!

Type: bug fix | new feature | code quality | documentation
Link to issue:

In raising this pull request, I confirm the following:

[x] I have read and understood the Contributing Guidelines
[x] I have checked that another pull request for this purpose does not exist
[x] I wrote some tests for this PR
[ ] I have updated the relevant CHANGELOG
[ ] I have created a PR for the documentation about this change

Small description of change:

Thanks

raicabogdan commented 2 months ago

Unfortunately this is not that simple, it also needs a way to be able to accept reading the header only from specific trusted proxies, you can't just take the forwarded_proto header and use it as a last resort like that without verifying you trust that header.

Dealing with proxies needs to be careful and I would rather leave this into the control of the proxy backend, or in this case the origin server to read the header and update it for us. But this can be taken into v6 I believe, it is worth having a way to detect if this is a proxy and work with it.

elcreator commented 2 months ago

I think this should not be implemented this way as local environment setup for testing the load balancer can also be plain HTTP and we should not confuse developers who will receive SSL error instead of response. X-Forwarded-Proto is about scheme browser use to connect to the load balancer (if it exists) https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Proto .