[vidarl]

Question	Answer
JIRA issue	IBX-11181
Type	bug
Target Ibexa version	v4.6
BC breaks	no

Related PRs:

• IBX-11181: Fixed setting Trusted Proxies on Ibexa Cloud core#699
• IBX-11181: Filtered client-supplied X-Forwarded-* headers in Varnish VCL http-cache#87
• IBX-11181: Added trusted_proxies ACL to Varnish setup docker#65
• IBX-11181: Filtered client-supplied X-Forwarded-* headers in Varnish VCL cloud#13
• https://github.com/ibexa/fastly/pull/63
• IBX-11181: [ibexa/core] Removed ibexa.trusted_header_client_ip_name from experience and commerce recipes recipes-dev#274
• IBX-11181: Updated trusted proxies tip for Fastly on Ibexa Cloud documentation-developer#3442

Follow-up to ibexa/core#699, which makes Ibexa DXP declare the peer a trusted proxy when a request
arrives via Fastly on Ibexa Cloud. Once trusted proxies are in play, every X-Forwarded-* header a
client sends is believed by Symfony, so the VCL has to stop them from reaching the application.

Per the Upsun header documentation the
router is authoritative for X-Forwarded-Proto, X-Client-IP and Client-Cdn, and discards
whatever the client sent for them. It says nothing about X-Forwarded-Host, X-Forwarded-Prefix or
RFC 7239 Forwarded, and states that it otherwise passes request headers through - so those three
arrive client controlled and are now stripped.

X-Forwarded-For needed more care. Without a CDN the router only appends the real client IP to
whatever the client sent, so every leading entry is client controlled. X-Client-IP is authoritative
in both the CDN and the non-CDN case, so it becomes the sole value of X-Forwarded-For. If it is
absent the request did not come through the router at all, and the header is dropped.

No trusted_proxies ACL here, unlike the VCLs in ibexa/http-cache: client.ip is not reliable on
Upsun, where REMOTE_ADDR is spoofed to the end user IP.

For QA:

Check that https URL generation still works behind a TLS terminator once its IP is added to the
trusted_proxies ACL, and that cache invalidation and the X-Cache debug headers are unaffected.
Easiest done using a custom controller that outputs those headers if they exists, maybe

Checklist:

• Provided PR description.
• Tested the solution manually.
• Provided automated test coverage.
• Checked that target branch is set correctly (main for features, the oldest supported for bugs).
• Ran PHP CS Fixer for new PHP code (use $ composer fix-cs).
• Asked for a review (ping @ibexa/engineering).

[ViniTou]

arent we missing VCL: resources/platformsh/common/4.6/.platform/varnish9.vcl here as well? I know, there is default fallback to it, but it will be easier to fix on merge up?