I am completely new to the back-end issues, so I would appreciate any detailed answers with explanation.
We need to configure our settings.php file so that it works with Varnish and CDN. Currently, it's commented out by default. I read the comments over and over in the settings.php, and it doesn't make much sense, or I don't know how to provide the information.
In the most simple scenario, the proxy server will add an X-Forwarded-For header to the request that contains the client IP address. However, HTTP headers are vulnerable to spoofing, where a malicious client could bypass restrictions by setting the X-Forwarded-For header directly. Therefore, Drupal's proxy configuration requires the IP addresses of all remote proxies to be specified in $conf['reverse_proxy_addresses'] to work correctly.
In order for this setting to be used you must specify every possible reverse proxy IP address in $conf['reverse_proxy_addresses']. If a complete list of reverse proxies is not available in your environment (for example, if you use a CDN) you may set the $_SERVER['REMOTE_ADDR'] variable directly in settings.php. Be aware, however, that it is likely that this would allow IP address spoofing unless more advanced precautions are taken.
Several things that concern me:
- What comments do I need to uncomment?
- Since I'm using a CDN, I guess I'll have to use: $_SERVER['REMOTE_ADDR']. But what are the "advanced precautions" available that I can take to prevent IP spoofing?