Merge remote-tracking branch 'origin/2.5' into 2.5

ezsystems · Oct 26, 2020 · 0de9f3b · 0de9f3b
2 parents 714ec5e + 681cc95
commit 0de9f3b
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/doc/docker/varnish.yml b/doc/docker/varnish.yml
@@ -9,9 +9,11 @@ services:
   app:
     environment:
      - SYMFONY_HTTP_CACHE=0
-     - SYMFONY_TRUSTED_PROXIES=varnish
+     # Never do this in production if the app container is accesible for the public as well
+     # See https://ezplatform.com/security-advisories/ezsa-2020-002-unauthorised-cache-purge-with-misconfigured-fastly for more details how it could be abused
+     - SYMFONY_TRUSTED_PROXIES=TRUST_REMOTE 
      - HTTPCACHE_PURGE_SERVER=http://varnish
-     - HTTPCACHE_PURGE_TYPE=http
+     - HTTPCACHE_PURGE_TYPE=varnish
 
   varnish:
     build: