Description
When a Symfony application is running behind a proxy or a load-balancer, you can tell Symfony to look for the X-Forwarded-* HTTP headers. HTTP headers that are not part of the "trusted_headers" allowed list are ignored and protect you from "Cache poisoning" attacks.
In Symfony 5.2, we've added support for the X-Forwarded-Prefix header, but this header was accessible in sub-requests, even if it was not part of the "trusted_headers" allowed list. An attacker could leverage this opportunity to forge requests containing a X-Forwarded-Prefix HTTP header, leading to a web cache poisoning issue.
Resolution
Symfony now ensures that the X-Forwarded-Prefix HTTP header is not forwarded to sub-requests when it is not trusted.
The patch for this issue is available here for branch 5.3.
Credits
We would like to thank Soner Sayakci for reporting the issue and Jérémy Derussé for fixing the issue.
Sponsor the Symfony project.Autentifică-te pentru a adăuga comentarii
Alte posturi din acest grup
Symfony 7.3 includes many small improvements aimed at making developers' lives easier and more productive. This blog post highlights some of the most useful DX (Developer Experience) features added in
Symfony 7.3 introduces several enhancements to the Validator component, focusing on developer experience, better configurability, and more expressive constraint definitions.
Allow to Disable Translat
Symfony 7.3 adds a new JsonStreamer component as a high-performance, low-memory JSON encoding and decoding utility. However, the Serializer component still has many valid use cases, even for JSON cont
Symfony 7.3.0-RC1 has just been released. This is a pre-release version of Symfony 7.3. If you want to test it in your own applications before its final release, run the following commands:
This week, development activity focused on putting the final touches on Symfony 7.3 in preparation for its stable release next week. In addition, we published a security fix for a potential vulnerabil
Symfony's bridge packages integrate third-party services, such as mailers, notifiers, and translation providers, into Symfony applications. With more than 120 bridges available today, Symfony supports
Symfony Messenger component keeps evolving to meet the needs of complex, modern applications. In Symfony 7.3, we're introducing several powerful features to it.
Run Process Using the Shell… https://s
