Skip to content

Fix docs on trusted hosts #10138

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

Fix docs on trusted hosts #10138

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
18cd129
fixed docs on trusted hosts
fabpot Aug 1, 2018
fd18b9f
fixed typo
fabpot Aug 2, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 9 additions & 9 deletions reference/configuration/framework.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -379,16 +379,16 @@ method might be vulnerable to some of these attacks because it depends on
the configuration of your web server. One simple solution to avoid these
attacks is to whitelist the hosts that your Symfony application can respond
to. That's the purpose of this ``trusted_hosts`` option. If the incoming
request's hostname doesn't match one in this list, the application won't
respond and the user will receive a 500 response.
request's hostname doesn't match one of the regular expressions in this list,
the application won't respond and the user will receive a 400 response.

.. configuration-block::

.. code-block:: yaml

# app/config/config.yml
framework:
trusted_hosts: ['example.com', 'example.org']
trusted_hosts: ['^example\.com$', '^example\.org$']

.. code-block:: xml

Expand All @@ -402,8 +402,8 @@ respond and the user will receive a 500 response.
http://symfony.com/schema/dic/symfony http://symfony.com/schema/dic/symfony/symfony-1.0.xsd">

<framework:config>
<framework:trusted-host>example.com</framework:trusted-host>
<framework:trusted-host>example.org</framework:trusted-host>
<framework:trusted-host>^example\.com$</framework:trusted-host>
<framework:trusted-host>^example\.org$</framework:trusted-host>
<!-- ... -->
</framework:config>
</container>
Expand All @@ -412,17 +412,17 @@ respond and the user will receive a 500 response.

// app/config/config.php
$container->loadFromExtension('framework', array(
'trusted_hosts' => array('example.com', 'example.org'),
'trusted_hosts' => array('^example\.com$', '^example\.org$'),
));

Hosts can also be configured using regular expressions (e.g. ``^(.+\.)?example.com$``),
which make it easier to respond to any subdomain.
Hosts can also be configured to respond to any subdomain, via
``^(.+\.)?example\.com$`` for instance.

In addition, you can also set the trusted hosts in the front controller
using the ``Request::setTrustedHosts()`` method::

// web/app.php
Request::setTrustedHosts(array('^(.+\.)?example.com$', '^(.+\.)?example.org$'));
Request::setTrustedHosts(array('^(.+\.)?example\.com$', '^(.+\.)?example\.org$'));

The default value for this option is an empty array, meaning that the application
can respond to any given host.
Expand Down