Limits on Trusting Proxy Headers in CakePHP 4.x/5.x
Goal Ensure that Request::getClientIp() and Request::is('ssl') return correct values when the application sits behind a reverse proxy such as an AWS ALB or Nginx. Constraints Local development runs without a proxy; the default trustProxy => false works. Production introduces X-Forwarded-For , X-Forwarded-Proto , and X-Forwarded-Host headers that must be i
cakephp