nette / http / 29305138811

84%

master: 83%

Build Type

push

github

Committed by dg

Commit Message

HttpExtension: default to trusting X-Forwarded-For only (BC break!)

Changes the configured default of `proxyHeaders` from "both" to "xForwarded",
so an application behind a proxy no longer trusts a client-supplied "Forwarded"
header by default (the common proxy sets X-Forwarded-For). The RequestFactory
PHP default is intentionally left at "both" for BC; this hardens only the
framework configuration.

BC: deployments whose proxy uses the "Forwarded" header must now set
`proxyHeaders: forwarded` (or `both`).

Coverage Stats

1 of 1 new or added line in 1 file covered. (100.0%)

25 existing lines in 2 files now uncovered.

1094 of 1298 relevant lines covered (84.28%)

0.84 hits per line