- How do I install robertboes/laravel-cloudflare-proxies in a Laravel app?
- Install it with Composer as a direct dependency and pin an explicit version, for example composer require robertboes/laravel-cloudflare-proxies. Publish the package configuration if you need to customize it. The package registers Cloudflare IPv4 and IPv6 ranges as trusted proxies and integrates with Laravel's TrustProxies middleware. There are no migrations or data-model changes.
- Does this package support Laravel 12?
- Yes, it targets Laravel 12 and the Symfony 7.x line that Laravel 12 allows. The v0.1.1 release specifically claims compatibility across every Symfony version permitted by Laravel 12. Because earlier behavior varied by Symfony minor, verify that compatibility in your own dependency matrix before relying on it. Run tests against the lowest and highest Symfony minors your constraint admits.
- How does this package make Laravel see the real visitor IP behind Cloudflare?
- Cloudflare forwards requests from its edge IPs and includes the visitor address in forwarded headers. The package configures Laravel's trusted proxies with Cloudflare's IPv4 and IPv6 ranges so the framework trusts those headers only when the request comes from a Cloudflare edge. Laravel can then resolve the client IP instead of seeing a Cloudflare edge address. This improves logging, rate limiting, security checks, and any IP-based logic.
- Do I need to change my TrustProxies middleware to use this package?
- The package integrates with Laravel's TrustProxies middleware rather than requiring you to hard-code proxy addresses yourself. You still need to ensure your application uses the middleware as normal for trusted proxy handling. Review the published config and any environment-specific settings before enabling it broadly. Keep the setup framework-native and avoid duplicating proxy lists elsewhere.
- Is the Cloudflare IP range list configurable?
- The package provides publishable configuration for customization. Treat the trusted proxy list as security-sensitive: too permissive a list allows X-Forwarded-For spoofing, while too restrictive a list can silently break legitimate traffic. Confirm whether rejection ranges such as private, CGNAT, documentation, loopback, link-local, and IPv6 equivalents are configurable or hard-coded in the version you adopt. Hard-coded can be safer but may not suit every topology.
- What is the refresh flag and should I enable it in production?
- The package behavior is gated behind a refresh flag that re-evaluates its proxy list at runtime rather than only at boot. Before enabling it in production, determine whether refresh re-resolves on every request, on a schedule, or on cache miss, because that drives latency and the staleness failure mode. Also confirm what happens if refresh fails: does it keep the last good list or fall back to config? A sensible rollout is to keep refresh disabled by default and enable it per environment after testing.
- Does the package handle IPv6 Cloudflare ranges?
- Yes, the package registers Cloudflare IPv4 and IPv6 ranges as trusted proxies. That matters because Cloudflare can deliver requests over IPv6 and a partial list would leave some traffic resolving the wrong client address. When customizing config, keep both address families aligned with Cloudflare's published ranges. Re-check the list if Cloudflare updates its ranges.
- How do I test real client IP resolution behind Cloudflare?
- Use a smoke test that sends requests with forwarded headers from an allowed Cloudflare range and asserts the resolved client IP, plus another from an untrusted range to confirm it is not trusted. Run the package test suite against the lowest and highest Symfony minors your Laravel 12 constraint admits, because v0.1.1 exists to normalize version-dependent IP classification. Also verify that rate limiting and logging use the expected address. Avoid testing only on your local Symfony version.
- Is trusting Cloudflare proxies with this package safe against X-Forwarded-For spoofing?
- Proxy trust is a high-blast-radius control: if the trusted list is too permissive, clients can spoof X-Forwarded-For and forge the IP used by rate limits, audit logs, allowlists, and sometimes session or geo logic. This package aims to restrict trust to Cloudflare ranges, but you must verify the configured list and your topology. Ensure traffic cannot reach the app from untrusted sources while claiming to be a Cloudflare edge. The v0.1.1 fix addressed an over-permissive default on some Symfony versions, which shows why version-specific testing matters. Review the source and config before relying on it for security-sensitive decisions.
- Is v0.1.x stable enough for production?
- v0.1.1 is a pre-1.0, second-release package, so API, config keys, and semantics can change without notice and there is no demonstrated deprecation policy. For production, pin an explicit version, keep refresh disabled by default, and enable it per environment only after verification. Treat the pin as temporary scaffolding until a 1.0 release lands or the maintainer's release cadence is observable. Review the security disclosure path and support window before relying on it.