Skip to content

docs: document HTTP request filtering differences - #2561

Open
ousamabenyounes wants to merge 2 commits into
php:mainfrom
ousamabenyounes:docs/issue-2521-request-differences
Open

docs: document HTTP request filtering differences#2561
ousamabenyounes wants to merge 2 commits into
php:mainfrom
ousamabenyounes:docs/issue-2521-request-differences

Conversation

@ousamabenyounes

@ousamabenyounes ousamabenyounes commented Jul 26, 2026

Copy link
Copy Markdown
Contributor

Fix #2521.

Changes

  • Document request-filtering differences to check when migrating from Nginx or Apache plus PHP-FPM.
  • Add a TRACE method example showing how to reject it explicitly in the Caddyfile before php_server.
  • Mention that stricter header-name filtering may also need to be enforced by the Caddyfile or another proxy when migrating.
  • Keep FrankenPHP's default behavior unchanged.

Validation

Verified with Docker using dunglas/frankenphp:1.12.6-php8.5 and a PHP script that prints the request method and incoming HTTP_X_* server variables.

Default Caddyfile:

GET /index.php      -> 200, method=GET
TRACE /index.php    -> 200, method=TRACE
special header name -> passed to PHP as HTTP_X_SPECIAL!#$%&*+_^|~

With the documented matcher:

GET /index.php      -> 200, method=GET
TRACE /index.php    -> 405
special header name -> still passed to PHP unless filtered separately

Also ran git diff --check.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Should FrankenPHP reject TRACE requests in the default configuration?

1 participant