#concrete5 #5.7 How to work concrete5 behind a load balancer or a reverse proxy

concrete.php

<?php

/**
 * Always trust incoming request.
 * 
 * application/config/concrete.php
 * 
 * For more detail, see: http://symfony.com/doc/current/cookbook/request/load_balancer_reverse_proxy.html
 */

// Get remote address
$remoteIp = $_SERVER['REMOTE_ADDR'];

return [
    'security' => [
        'trusted_proxies' => [
            'ips' => [$remoteIp]
        ],
    ],
];

This gist can be dangerous! It's far better to configure the actual IPs you expect to proxy your connections rather than just allowing anyone to proxy you.

Yes, this gist can be dangerous. Please read the Symfony doc in the comment.

Some reverse proxies (like AWS Elastic Load Balancing) don't have a static IP address or even a range that you can target with the CIDR notation. In this case, you'll need to - very carefully - trust all proxies.
Configure your web server(s) to not respond to traffic from any clients other than your load balancers.