{"action":"created","issue":{"url":"https://api.github.com/repos/symphonycms/symphony-2/issues/2454","labels_url":"https://api.github.com/repos/symphonycms/symphony-2/issues/2454/labels{/name}","comments_url":"https://api.github.com/repos/symphonycms/symphony-2/issues/2454/comments","events_url":"https://api.github.com/repos/symphonycms/symphony-2/issues/2454/events","html_url":"https://github.com/symphonycms/symphony-2/issues/2454","id":82160423,"number":2454,"title":"Issues with cookie domain behind a reverse proxy","user":{"login":"michael-e","id":40072,"avatar_url":"https://avatars.githubusercontent.com/u/40072?v=3","gravatar_id":"","url":"https://api.github.com/users/michael-e","html_url":"https://github.com/michael-e","followers_url":"https://api.github.com/users/michael-e/followers","following_url":"https://api.github.com/users/michael-e/following{/other_user}","gists_url":"https://api.github.com/users/michael-e/gists{/gist_id}","starred_url":"https://api.github.com/users/michael-e/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michael-e/subscriptions","organizations_url":"https://api.github.com/users/michael-e/orgs","repos_url":"https://api.github.com/users/michael-e/repos","events_url":"https://api.github.com/users/michael-e/events{/privacy}","received_events_url":"https://api.github.com/users/michael-e/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":17,"created_at":"2015-05-28T22:57:07Z","updated_at":"2015-07-26T15:39:39Z","closed_at":null,"body":"If Symphony runs behind a reverse proxy, Symphony's server will probably listen to 127.0.0.1. In this case the `getDomain` function in `lib/toolkit/class.session.php` will cause issues:\r\n\r\n```php\r\npublic static function getDomain()\r\n{\r\n    if (isset($_SERVER['HTTP_HOST'])) {\r\n        if (preg_match('/(localhost|127\\.0\\.0\\.1)/', $_SERVER['HTTP_HOST']) || $_SERVER['SERVER_ADDR'] == '127.0.0.1') {\r\n            return null; // prevent problems on local setups\r\n        }\r\n        return preg_replace('/(^www\\.|:\\d+$)/i', null, $_SERVER['HTTP_HOST']);\r\n    }\r\n    return null;\r\n}\r\n```\r\n\r\nChecking for `$_SERVER['SERVER_ADDR'] == '127.0.0.1'` is no good idea in this case, because it will prevent Symphony from returning (and properly setting) the correct cookie domain.\r\n\r\nI don't remember why exactly we needed that \"prevent problems on local setups\" logic, but there must have been issues with certain browsers on certain \"localhost\" setups. Nevertheless, looking forward, I suggest to remove at least the mentioned part of the if clause, because it prevents correct cookies in real-world scenarios, for example Symphony running on Apache behind nginx as frontend server (and SSL terminator, in my case).\r\n\r\n(It really took me a while to find out what was causing my issues.)"},"comment":{"url":"https://api.github.com/repos/symphonycms/symphony-2/issues/comments/125009435","html_url":"https://github.com/symphonycms/symphony-2/issues/2454#issuecomment-125009435","issue_url":"https://api.github.com/repos/symphonycms/symphony-2/issues/2454","id":125009435,"user":{"login":"michael-e","id":40072,"avatar_url":"https://avatars.githubusercontent.com/u/40072?v=3","gravatar_id":"","url":"https://api.github.com/users/michael-e","html_url":"https://github.com/michael-e","followers_url":"https://api.github.com/users/michael-e/followers","following_url":"https://api.github.com/users/michael-e/following{/other_user}","gists_url":"https://api.github.com/users/michael-e/gists{/gist_id}","starred_url":"https://api.github.com/users/michael-e/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michael-e/subscriptions","organizations_url":"https://api.github.com/users/michael-e/orgs","repos_url":"https://api.github.com/users/michael-e/repos","events_url":"https://api.github.com/users/michael-e/events{/privacy}","received_events_url":"https://api.github.com/users/michael-e/received_events","type":"User","site_admin":false},"created_at":"2015-07-26T15:39:39Z","updated_at":"2015-07-26T15:39:39Z","body":"I wouldn't mind the point release, because it's just a bugfix in my eyes.  The `SERVER_ADDR` condition causes issues, and we don't remember if it ever did anything good. And _if_ it was useful, it must have been a workaround for a bug in somebody's environment.\r\n\r\nNo wonder we don't remember, the code [must be more than 6 years old](http://www.getsymphony.com/discuss/thread/853/). :-)\r\n\r\nNormally I am the one to say \"test, test test!\". But in this case I think it's pretty hard, simply because we don't know which problems to expect."}}