Limits on Trusting Proxy Headers in CakePHP 4.x/5.x

Goal

Ensure that Request::getClientIp() and Request::is('ssl') return correct values when the application sits behind a reverse proxy such as an AWS ALB or Nginx.

Constraints

• Local development runs without a proxy; the default trustProxy => false works.
• Production introduces X-Forwarded-For, X-Forwarded-Proto, and X-Forwarded-Host headers that must be interpreted.
• Enabling trustProxy => true without restricting trustedProxies could allow header spoofing.
• The framework requires explicit trustedHeaders bitmask configuration; the documentation lists four constants but does not recommend a default for common cloud load balancers.

Unresolved Decision

Which combination of trustedHeaders bits should be enabled, and how should trustedProxies be scoped, to achieve accurate client IP and SSL detection while preventing security risks?

Specific Questions

• Should trustedHeaders include HEADER_X_FORWARDED_PROTO to correctly detect SSL behind an ALB?
• Is trusting all X-Forwarded-For values from a single ALB safe, or must trustedProxies be limited to the ALB’s IP ranges?
• Does CakePHP 5.x automatically recognize ALB headers, or does it still require manual trustedProxies configuration?