Trusted proxy headers on Cloud Platform for Drupal sites¶

Changes to Drupal 9 or later¶

Drupal 9 or later supports the following proxy headers:

• X-Forwarded-For
• X-Forwarded-Host
• X-Forwarded-Port
• X-Forwarded-Proto
• Forwarded

However, Cloud Platform trusts the following proxy headers by default:

• X-Forwarded-For
• X-Forwarded-Proto

To ensure that Cloud Platform trusts the other supported proxy headers, you can re-enable such headers by updating your site’s settings.php file. For more information, see Ensuring that an application trusts the proxy headers. This applies to cases when your application uses other headers.

Verifying the proxy headers used by an application¶

To view the list of proxy headers used by your application:

1. Access your Acquia-hosted Drupal site as an admin user. Ensure that you use the same public domain that your visitors use and not the *.acquia-sites.com domain.
2. Access Admin > Reports > Status Report > PHP (/admin/reports/status/php) where the request headers used by the application is displayed.

To enable the proxy headers, add the code mentioned in the Ensuring that an application trusts the proxy headers section.

For any assistance, contact Acquia support.

Ensuring that an application trusts the proxy headers¶

If your application uses other trusted proxy headers, you must add a setting for each header to your settings.php file after the require line. For example,

   // Trust the X-Forwarded-Host header.
if (isset($settings['reverse_proxy_trusted_headers'])) {
$settings['reverse_proxy_trusted_headers'] |= \Symfony\Component\HttpFoundation\Request::HEADER_X_FORWARDED_HOST;
}

else
{

$settings['reverse_proxy_host_header'] = 'X_FORWARDED_HOST';

}

For other proxy headers, access Drupal’s default.settings.php file.

Acquia recommends that you test the behavior to ensure that the change does not impact your application.