TrustedHostsRequestFactory.php

<?php

namespace Drupal\Core\Http;

use Symfony\Component\HttpFoundation\Request;

/**
 * Provides a request factory for requests using host verification.
 *
 * Because the trusted host patterns for requests are stored statically, they
 * are consulted even for fake request created with Request::create(), whose
 * host is 'localhost' by default. Such requests would fail host verification
 * unless 'localhost' matches one of the trusted host patterns. To circumvent
 * this problem, this factory injects the server variables from the main request
 * into each newly created request, so that the host is correctly set even for
 * fake requests and they properly pass host verification.
 *
 * @see \Drupal\Core\DrupalKernel::setupTrustedHosts()
 */
class TrustedHostsRequestFactory {

  /**
   * The host of the main request.
   *
   * @var string
   */
  protected $host;

  /**
   * Creates a new TrustedHostsRequestFactory.
   *
   * @param string $host
   *   The host of the main request.
   */
  public function __construct($host) {
    $this->host = (string) $host;
  }

  /**
   * Creates a new request object.
   *
   * @param array $query
   *   (optional) The query (GET) or request (POST) parameters.
   * @param array $request
   *   (optional) An array of request variables.
   * @param array $attributes
   *   (optional) An array of attributes.
   * @param array $cookies
   *   (optional) The request cookies ($_COOKIE).
   * @param array $files
   *   (optional) The request files ($_FILES).
   * @param array $server
   *   (optional) The server parameters ($_SERVER).
   * @param string $content
   *   (optional) The raw body data.
   *
   * @return \Symfony\Component\HttpFoundation\Request
   *   A new request object.
   */
  public function createRequest(array $query = [], array $request = [], array $attributes = [], array $cookies = [], array $files = [], array $server = [], $content = NULL) {
    if (empty($server['HTTP_HOST']) || $server['HTTP_HOST'] === 'localhost' && $this->host !== 'localhost') {
      $server['HTTP_HOST'] = $this->host;
    }
    return new Request($query, $request, $attributes, $cookies, $files, $server, $content);
  }

}