From 178678e36e9b7e18aead12a3d7d96a7ea40c8028 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vi=CC=81ctor=20Falco=CC=81n?= Date: Fri, 3 Jul 2026 16:35:31 +0200 Subject: [PATCH] fix(security): trim TRUSTED_PROXIES entries and document the var Whitespace after commas in TRUSTED_PROXIES produced invalid IP/CIDR entries; trim each. Document the variable in .env.production.example so proxy deployments configure it instead of silently losing the real client IP (which also makes the new per-IP throttles spoofable). --- .env.production.example | 8 ++++++++ bootstrap/app.php | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/.env.production.example b/.env.production.example index 57c84d36..61d9d1ad 100644 --- a/.env.production.example +++ b/.env.production.example @@ -14,6 +14,14 @@ APP_LOCALE=en APP_FALLBACK_LOCALE=en APP_FAKER_LOCALE=en_US +# Trusted Proxies +# Comma-separated proxy IPs/CIDRs Laravel trusts for X-Forwarded-* headers (no spaces). +# Required when running behind a reverse proxy (Coolify/Traefik, nginx, Cloudflare): +# without it the app cannot see the real client IP (rate limiting breaks and becomes +# spoofable) nor detect HTTPS (redirect loops). The private ranges below cover the +# Docker network the proxy connects from; leave unset only when there is no proxy. +TRUSTED_PROXIES=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 + # Logging LOG_CHANNEL=stack LOG_STACK=single,sentry_logs diff --git a/bootstrap/app.php b/bootstrap/app.php index 404e9296..70c38bce 100644 --- a/bootstrap/app.php +++ b/bootstrap/app.php @@ -33,7 +33,7 @@ return Application::configure(basePath: dirname(__DIR__)) $trustedProxies = env('TRUSTED_PROXIES'); $middleware->trustProxies( - at: is_string($trustedProxies) ? explode(',', $trustedProxies) : null, + at: is_string($trustedProxies) ? array_map('trim', explode(',', $trustedProxies)) : null, headers: Request::HEADER_X_FORWARDED_FOR | Request::HEADER_X_FORWARDED_HOST | Request::HEADER_X_FORWARDED_PORT