// If this request is coming from within the cluster, we'll trust HTTP
// headers added by the load balancer. We do not trust these headers for
// requests which do not originate from within the cluster, because they
// are client-controlled if the request is being received directly.
if (PhacilityServices::isClusterRequest()) {
// Since we terminate SSL at the ELB, requests are normally HTTP by the
// time they reach the server, even if they were originally HTTPS. The
// ELB sets this header to indicate that the original request was HTTPS.
if (idx($_SERVER, 'HTTP_X_FORWARDED_PROTO') == 'https') {
$_SERVER['HTTPS'] = true;
}
$forwarded_for = idx($_SERVER, 'HTTP_X_FORWARDED_FOR');
if ($forwarded_for) {
$_SERVER['REMOTE_ADDR'] = $forwarded_for;
}
}