diff --git a/.env.example b/.env.example index 683d421d..0875d02b 100644 --- a/.env.example +++ b/.env.example @@ -146,6 +146,12 @@ WEBAUTHN_ICON= WEBAUTHN_USER_VERIFICATION= +# Use this setting to declare trusted proxied. +# Supported: +# '*': to trust any proxy +# A comma separated IP list: The list of proxies IP to trust + +TRUSTED_PROXIES= # Leave the following configuration vars as is. # Unless you like to tinker and know what you're doing. diff --git a/Dockerfile b/Dockerfile index 2aab4014..23d76112 100644 --- a/Dockerfile +++ b/Dockerfile @@ -191,6 +191,11 @@ ENV \ # 'preferred' (default) : Will ask for user verification IF POSSIBLE # 'discouraged' : Will NOT ask for user verification (for example, to minimize disruption to the user interaction flow) WEBAUTHN_USER_VERIFICATION= \ + # Use this setting to declare trusted proxied. + # Supported: + # '*': to trust any proxy + # A comma separated IP list: The list of proxies IP to trust + TRUSTED_PROXIES= \ # Leave the following configuration vars as is. # Unless you like to tinker and know what you're doing. BROADCAST_DRIVER=log \ diff --git a/app/Http/Middleware/TrustProxies.php b/app/Http/Middleware/TrustProxies.php index e29237d3..4f42db96 100644 --- a/app/Http/Middleware/TrustProxies.php +++ b/app/Http/Middleware/TrustProxies.php @@ -25,4 +25,12 @@ class TrustProxies extends Middleware Request::HEADER_X_FORWARDED_PORT | Request::HEADER_X_FORWARDED_PROTO | Request::HEADER_X_FORWARDED_AWS_ELB; + + /** + * TrustProxies constructor. + */ + public function __construct() + { + $this->proxies = (string) config('2fauth.config.trustedProxies'); + } } \ No newline at end of file diff --git a/config/2fauth.php b/config/2fauth.php index ae325af3..ea0ac84a 100644 --- a/config/2fauth.php +++ b/config/2fauth.php @@ -20,6 +20,7 @@ 'config' => [ 'isDemoApp' => env('IS_DEMO_APP', false), + 'trustedProxies' => env('TRUSTED_PROXIES', null), ], /* diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml index 52dee848..ba657202 100644 --- a/docker/docker-compose.yml +++ b/docker/docker-compose.yml @@ -91,6 +91,11 @@ services: # 'preferred' (default) : Will ask for user verification IF POSSIBLE # 'discouraged' : Will NOT ask for user verification (for example, to minimize disruption to the user interaction flow) - WEBAUTHN_USER_VERIFICATION= + # Use this setting to declare trusted proxied. + # Supported: + # '*': to trust any proxy + # A comma separated IP list: The list of proxies IP to trust + - TRUSTED_PROXIES= # Leave the following configuration vars as is. # Unless you like to tinker and know what you're doing. - BROADCAST_DRIVER=log