I need to set a trusted proxy in my installation so that secure cookie flags are set correctly.

Currently as a temporary measure i am setting the following in index.php

$proxies = [''];

However i would like to be able to set a new trusted proxy from a settings file or module that will persist through a core update without needed to patch.

Where is the best place to specify this?

2 Answers 2


Drupal doesn't want you to place custom code in index.php to prepare a request before it is handled by the Drupal kernel. So it was made possible for modules to implement a middleware through StackedHttpKernel.

In this case such a middleware already exists, which reads the reverse proxy addresses from settings.php and adds them as trusted proxies to the request:


  $proxies = $settings->get('reverse_proxy_addresses', []);
  if (count($proxies) > 0) {
    $request::setTrustedProxies($proxies, Request::HEADER_X_FORWARDED_ALL | Request::HEADER_FORWARDED);

So you can simply enable this settings in settings.php:

$settings['reverse_proxy'] = TRUE;
$settings['reverse_proxy_addresses'] = ['a.b.c.d', ...];

All the other proxy settings are in settings.php so I think that would be the most appropriate place.

This would persist after core updates and as a new developer on boarding onto a project that is the first place I would check for this sort of configuration.

  • 1
    Do you know exactly what the syntax is for setting them in settinsg.php?
    – Rob Holmes
    Sep 20, 2018 at 9:10
  • 1
    You have the syntax right. See Drupal documentation on Request::setTrustedProxies and there is an example of it in use on the HttpCache.php page.
    – Felix Eve
    Sep 20, 2018 at 9:14
  • 1
    Ah ok, i thought there might have been a $settings['trustedproxies'] = [...] kind of syntax specifically for settings.php as i've never seen any direct code in a settings file before.
    – Rob Holmes
    Sep 20, 2018 at 9:16
  • 1
    No, I don't think anything like that exists. There are a few modules that require adding small code blocks to settings.php so think it is fine.
    – Felix Eve
    Sep 20, 2018 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.