Introduction
What does it do?
This extension reads AWS's publicly published CloudFront edge IP ranges (both
IPv4 and IPv6) and appends them to
$GLOBALS, so TYPO3
resolves the real client IP from CloudFront's X- headers instead
of seeing CloudFront's own IP. A PSR-15 middleware does this before TYPO3's
normalized- middleware reads reverse. Any
reverse you already configured is kept and extended, not replaced.
The list is read from AWS on the first request and then stored in TYPO3's
caching framework (registered as the cloudfront_ cache) as
compiled PHP — that even lands the list in PHP's opcode cache, so it's read
back faster than going through TYPO3's caching framework alone. Every
following request is served from that cache; only once it's missing or older
than 24 hours is it refetched from AWS. If a refetch fails (AWS unreachable,
bad response, ...), the middleware falls back to the last successfully
fetched list rather than failing the request or dropping proxy trust
entirely.
Why is this needed?
When TYPO3 runs behind AWS CloudFront, every request arrives from one of
CloudFront's edge server IPs, not from the actual visitor. Without telling
TYPO3 to trust those IPs as reverse proxies, TYPO3 can't correctly resolve
the visitor's real IP address from the X- header — which
matters for things like IP-based access restrictions, logging, GeoIP lookups,
or rate limiting. Since AWS regularly adds and removes edge IP ranges, hand
maintaining reverse isn't practical; this extension keeps that list
current automatically.
Screenshots
This extension has no backend module or user interface — it works entirely in the background via a request middleware.