@@ -15,25 +15,31 @@ cached content fast and including support for :ref:`Edge Side Includes <edge-sid
1515Make Symfony Trust the Reverse Proxy
1616------------------------------------
1717
18- For ESI to work correctly and for the :ref: `X-FORWARDED <varnish-x-forwarded-headers >`
19- headers to be used, you need to configure Varnish as a
20- :doc: `trusted proxy </cookbook/request/load_balancer_reverse_proxy >`.
18+ Varnish automatically forwards the IP as ``X-Forwarded-For `` and leaves the
19+ ``X-Forwarded-Proto `` header in the request. If you do not configure Varnish as
20+ trusted proxy, Symfony will see all requests as coming through insecure HTTP
21+ connections from the Varnish host instead of the real client.
22+
23+ Remember to configure :ref: `framework.trusted_proxies <reference-framework-trusted-proxies >`
24+ in the Symfony configuration so that Varnish is seen as a trusted proxy and the
25+ :ref: `X-Forwarded <varnish-x-forwarded-headers >` headers are used.
2126
2227.. _varnish-x-forwarded-headers :
2328
2429Routing and X-FORWARDED Headers
2530-------------------------------
2631
27- To ensure that the Symfony Router generates URLs correctly with Varnish,
28- a ``X-Forwarded-Port `` header must be present for Symfony to use the
29- correct port number.
32+ If the ``X-Forwarded-Port `` header is not set correctly, Symfony will append
33+ the port where the PHP application is running when generating absolute URLs,
34+ e.g. ``http://example.com:8080/my/path ``. To ensure that the Symfony router
35+ generates URLs correctly with Varnish, add the correct port number in the
36+ ``X-Forwarded-Port `` header. This port depends on your setup.
3037
31- This port depends on your setup. Lets say that external connections come in
32- on the default HTTP port 80. For HTTPS connections, there is another proxy
33- (as Varnish does not do HTTPS itself) on the default HTTPS port 443 that
34- handles the SSL termination and forwards the requests as HTTP requests to
35- Varnish with a ``X-Forwarded-Proto `` header. In this case, you need to add
36- the following configuration snippet:
38+ Suppose that external connections come in on the default HTTP port 80. For HTTPS
39+ connections, there is another proxy (as Varnish does not do HTTPS itself) on the
40+ default HTTPS port 443 that handles the SSL termination and forwards the requests
41+ as HTTP requests to Varnish with a ``X-Forwarded-Proto `` header. In this case,
42+ add the following to your Varnish configuration:
3743
3844.. code-block :: varnish4
3945
@@ -45,45 +51,30 @@ the following configuration snippet:
4551 }
4652 }
4753
48- .. note ::
49-
50- Remember to configure :ref: `framework.trusted_proxies <reference-framework-trusted-proxies >`
51- in the Symfony configuration so that Varnish is seen as a trusted proxy
52- and the ``X-Forwarded-* `` headers are used.
53-
54- Varnish automatically forwards the IP as ``X-Forwarded-For `` and leaves
55- the ``X-Forwarded-Proto `` header in the request. If you do not configure
56- Varnish as trusted proxy, Symfony will see all requests as coming through
57- insecure HTTP connections from the Varnish host instead of the real client.
58-
59- If the ``X-Forwarded-Port `` header is not set correctly, Symfony will append
60- the port where the PHP application is running when generating absolute URLs,
61- e.g. ``http://example.com:8080/my/path ``.
62-
6354 Cookies and Caching
6455-------------------
6556
6657By default, a sane caching proxy does not cache anything when a request is sent
67- with :ref: `cookies or a basic authentication header<http-cache-introduction> `.
58+ with :ref: `cookies or a basic authentication header <http-cache-introduction >`.
6859This is because the content of the page is supposed to depend on the cookie
6960value or authentication header.
7061
7162If you know for sure that the backend never uses sessions or basic
72- authentication, have varnish remove the corresponding header from requests to
63+ authentication, have Varnish remove the corresponding header from requests to
7364prevent clients from bypassing the cache. In practice, you will need sessions
7465at least for some parts of the site, e.g. when using forms with
7566:ref: `CSRF Protection <forms-csrf >`. In this situation, make sure to
7667:doc: `only start a session when actually needed </cookbook/session/avoid_session_start >`
7768and clear the session when it is no longer needed. Alternatively, you can look
7869into :doc: `/cookbook/cache/form_csrf_caching `.
7970
80- Cookies created in Javascript and used only in the frontend, e.g. when using
81- Google analytics are nonetheless sent to the server. These cookies are not
71+ Cookies created in JavaScript and used only in the frontend, e.g. when using
72+ Google Analytics, are nonetheless sent to the server. These cookies are not
8273relevant for the backend and should not affect the caching decision. Configure
8374your Varnish cache to `clean the cookies header `_. You want to keep the
8475session cookie, if there is one, and get rid of all other cookies so that pages
8576are cached if there is no active session. Unless you changed the default
86- configuration of PHP, your session cookie has the name PHPSESSID:
77+ configuration of PHP, your session cookie has the name `` PHPSESSID `` :
8778
8879.. code-block :: varnish4
8980
@@ -110,8 +101,8 @@ configuration of PHP, your session cookie has the name PHPSESSID:
110101 implemented and explained by the FOSHttpCacheBundle _ under the name
111102 `User Context `_.
112103
113- Ensure Consistent Caching Behaviour
114- -----------------------------------
104+ Ensure Consistent Caching Behavior
105+ ----------------------------------
115106
116107Varnish uses the cache headers sent by your application to determine how
117108to cache content. However, versions prior to Varnish 4 did not respect
@@ -143,7 +134,7 @@ using Varnish 3:
143134Enable Edge Side Includes (ESI)
144135-------------------------------
145136
146- As explained in the :ref: `Edge Side Includes section<edge-side-includes> `,
137+ As explained in the :ref: `Edge Side Includes section <edge-side-includes >`,
147138Symfony detects whether it talks to a reverse proxy that understands ESI or
148139not. When you use the Symfony reverse proxy, you don't need to do anything.
149140But to make Varnish instead of Symfony resolve the ESI tags, you need some
@@ -168,10 +159,11 @@ application:
168159
169160 .. note ::
170161
171- The ``abc `` part of the header isn't important unless you have multiple "surrogates"
172- that need to advertise their capabilities. See `Surrogate-Capability Header `_ for details.
162+ The ``abc `` part of the header isn't important unless you have multiple
163+ "surrogates" that need to advertise their capabilities. See
164+ `Surrogate-Capability Header `_ for details.
173165
174- Then, optimize Varnish so that it only parses the Response contents when there
166+ Then, optimize Varnish so that it only parses the response contents when there
175167is at least one ESI tag by checking the ``Surrogate-Control `` header that
176168Symfony adds automatically:
177169
0 commit comments