{"action":"created","issue":{"url":"https://api.github.com/repos/symfony/symfony-docs/issues/6197","labels_url":"https://api.github.com/repos/symfony/symfony-docs/issues/6197/labels{/name}","comments_url":"https://api.github.com/repos/symfony/symfony-docs/issues/6197/comments","events_url":"https://api.github.com/repos/symfony/symfony-docs/issues/6197/events","html_url":"https://github.com/symfony/symfony-docs/issues/6197","id":129453998,"number":6197,"title":"TrustedHeaderNames are not standard","user":{"login":"xDaizu","id":7584835,"avatar_url":"https://avatars.githubusercontent.com/u/7584835?v=3","gravatar_id":"","url":"https://api.github.com/users/xDaizu","html_url":"https://github.com/xDaizu","followers_url":"https://api.github.com/users/xDaizu/followers","following_url":"https://api.github.com/users/xDaizu/following{/other_user}","gists_url":"https://api.github.com/users/xDaizu/gists{/gist_id}","starred_url":"https://api.github.com/users/xDaizu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xDaizu/subscriptions","organizations_url":"https://api.github.com/users/xDaizu/orgs","repos_url":"https://api.github.com/users/xDaizu/repos","events_url":"https://api.github.com/users/xDaizu/events{/privacy}","received_events_url":"https://api.github.com/users/xDaizu/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-01-28T13:31:43Z","updated_at":"2016-02-01T16:23:07Z","closed_at":null,"body":"The default proxy Headers\r\n```\r\n\r\nRequest::setTrustedHeaderName(Request::HEADER_CLIENT_IP, 'X-Proxy-For');\r\nRequest::setTrustedHeaderName(Request::HEADER_CLIENT_HOST, 'X-Proxy-Host');\r\nRequest::setTrustedHeaderName(Request::HEADER_CLIENT_PORT, 'X-Proxy-Port');\r\nRequest::setTrustedHeaderName(Request::HEADER_CLIENT_PROTO, 'X-Proxy-Proto');\r\n```\r\n\r\ndon't follow the standard [RFC 7239](http://tools.ietf.org/html/rfc7239) (although it seems barely anyone does). Wouldn't it be nice to do it?"},"comment":{"url":"https://api.github.com/repos/symfony/symfony-docs/issues/comments/178053504","html_url":"https://github.com/symfony/symfony-docs/issues/6197#issuecomment-178053504","issue_url":"https://api.github.com/repos/symfony/symfony-docs/issues/6197","id":178053504,"user":{"login":"xDaizu","id":7584835,"avatar_url":"https://avatars.githubusercontent.com/u/7584835?v=3","gravatar_id":"","url":"https://api.github.com/users/xDaizu","html_url":"https://github.com/xDaizu","followers_url":"https://api.github.com/users/xDaizu/followers","following_url":"https://api.github.com/users/xDaizu/following{/other_user}","gists_url":"https://api.github.com/users/xDaizu/gists{/gist_id}","starred_url":"https://api.github.com/users/xDaizu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xDaizu/subscriptions","organizations_url":"https://api.github.com/users/xDaizu/orgs","repos_url":"https://api.github.com/users/xDaizu/repos","events_url":"https://api.github.com/users/xDaizu/events{/privacy}","received_events_url":"https://api.github.com/users/xDaizu/received_events","type":"User","site_admin":false},"created_at":"2016-02-01T16:23:07Z","updated_at":"2016-02-01T16:23:07Z","body":"http://symfony.com/doc/current/components/http_foundation/trusting_proxies.html#configuring-header-names \r\n\r\nThis states: \r\n\r\n> By default, the following proxy headers are trusted:\r\n> \r\n>     X-Forwarded-For Used in getClientIp();\r\n>     X-Forwarded-Host Used in getHost();\r\n>     X-Forwarded-Port Used in getPort();\r\n>     X-Forwarded-Proto Used in getScheme() and isSecure();\r\n\r\nMy point is those headers are not standard. They're common (pseudo-standard) but not standard [since the RFC 7239 was released in 2014](https://en.wikipedia.org/wiki/X-Forwarded-For), which is the one I linked in my original post. \r\n\r\nIt is not about what the Symfony2 documentation states, but about how Symfony2 behaves **by default**. Does it support the standard *Forwarded* header by default and all its attributes? If not, it should. In the same line, I put up to debate if it **should** follow the pseudo-standard by default. Is it useful? Yes, it is; but it can be argued that it fights against the extension of the standard, which I think is a burden mid-long term."}}