Reverse Proxies

A reverse proxy sits in front of the PHP application. It may terminate TLS, route traffic, balance requests, or cache selected responses. The application then sees a connection from the proxy rather than directly from the browser, so it needs a deliberate trust policy for forwarded headers.

Trust Forwarded Headers Narrowly

  • Trust proxy headers only from known proxy infrastructure.
  • Configure client IP and scheme handling deliberately.
  • Set timeouts and body-size limits consistently.

Verify The Whole Request Path

  • Verify HTTPS URL generation.
  • Check client IP logs.
  • Exercise large request and timeout behaviour.

Common Failure Modes

  • Blind trust in forwarded headers enables spoofing.
  • Proxy and app timeout mismatches create confusing failures.
  • Caching authenticated responses can leak data.

Trusted Header Rule

Accept X-Forwarded-For and X-Forwarded-Proto only when the request came from an approved proxy address range.

Frameworks usually provide trusted-proxy configuration. Use it rather than scattering custom header parsing through controllers. Review caching rules separately and make sure personalised or authenticated responses cannot leak through an unsafe shared cache.

Proxy Responsibilities

A reverse proxy may terminate TLS, route hosts and paths, balance traffic, enforce request limits, cache responses, compress output, and attach forwarding metadata. Assign each responsibility to one layer so duplicated redirects, compression, or caching rules do not conflict.

Forwarded Identity

The application may need the original scheme, host, and client address. Trust forwarding headers only from known proxy addresses and configure the framework or server integration centrally. A direct client must not be able to claim an internal address or HTTPS origin through forged headers.

Timeouts And Buffering

Proxy connect, response, idle, and upload timeouts interact with PHP-FPM and application deadlines. Buffering can protect upstream workers from slow clients, but it changes streaming behavior. Test large uploads, streamed responses, and long-running endpoints through the complete chain.

Cache And Authentication

Do not cache personalized responses merely because they use GET. Review cookies, authorization headers, Cache-Control, Vary, and CDN rules together.

Practice

Practice: Review Trusted Proxy Settings

Review a deployment where a load balancer terminates TLS before forwarding traffic to the PHP application. Explain which forwarded headers the app can trust and how that trust is restricted.

Requirements

  • Trust proxy headers only from known proxy infrastructure.
  • Configure client IP and scheme handling deliberately.
  • Set timeouts and body-size limits consistently.
  • Verify HTTPS URL generation.
  • Check client IP logs.
  • Exercise large request and timeout behaviour.
Show solution

Configure the application or framework with the approved proxy address range. Accept forwarded client IP and scheme headers only for requests that arrived from that infrastructure. Do not trust internet-supplied forwarding headers by default.

Verify HTTPS URL generation, redirects, client-IP logs, body-size limits, and timeouts through the actual proxy path. Review cache rules separately and make sure personalised or authenticated responses cannot leak through an unsafe shared cache.

Practice: Map A Proxy Chain

Map client, CDN, load balancer, Nginx, PHP-FPM, and application responsibilities.

Your answer must identify the intended behavior, the important failure case, and the evidence that proves the result.

Show solution

Assign TLS, redirects, header trust, request limits, caching, compression, timeouts, health checks, and logging to explicit layers, then test the values the PHP application receives.

Verify the real response, deployment, or workload rather than relying only on configuration text.

Practice: Debug Forwarded Headers

An application generates HTTP links behind HTTPS and logs the proxy address as every client.

Your answer must identify the intended behavior, the important failure case, and the evidence that proves the result.

Show solution

Verify which proxy appends each forwarding header, configure trusted proxy ranges and header conventions centrally, reject direct spoofing, and test scheme, host, and client address through staging.

Verify the real response, deployment, or workload rather than relying only on configuration text.