Skip to content

Commit 77343f3

Browse files
committed
Added support for multiple chained proxies that append a comma and their hostnames to the previous X-Forwarded-Host header.
If we have Client <---> Fwd Proxy1 (first.proxy) <---> Fwd Proxy2 (second.proxy )<---> Application (third.server), then we will have these values for a script executed on third.server:: $_SERVER['HTTP_X_FORWARDED_HOST'] = 'first.proxy, second.proxy'; $_SERVER['HTTP_HOST'] = 'third.server'; If we use the raw value from $_SERVER['HTTP_X_FORWARDED_HOST'] for composing return URLs, we will generate invalid return URLs, in our case 'http://first.proxy, second.proxy/fb_oauth.php', and get a 'Oauth exception 191' or some other error message. If we properly process the X-Forwarded-Host value by taking the leftmost host, we will not get errors.
1 parent 69351a5 commit 77343f3

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

src/base_facebook.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1156,7 +1156,7 @@ protected function getUrl($name, $path='', $params=array()) {
11561156

11571157
protected function getHttpHost() {
11581158
if ($this->trustForwarded && isset($_SERVER['HTTP_X_FORWARDED_HOST'])) {
1159-
return $_SERVER['HTTP_X_FORWARDED_HOST'];
1159+
return strtok($_SERVER['HTTP_X_FORWARDED_HOST'], ',');
11601160
}
11611161
return $_SERVER['HTTP_HOST'];
11621162
}

0 commit comments

Comments
 (0)