The exclude/include path functionality is working well except the Drupal site is hosted behind a reverse proxy.
Expected result:
The user login page is protected by the shield.
Actual result:
Those pages are not protected, if the Drupal site is sitting behind a reverse proxy.
Drupal core provides the Drupal\Core\StackMiddleware\ReverseProxyMiddleware to deal with reverse proxy for a StackPHP middleware implementation.
Details See https://api.drupal.org/api/drupal/core%21lib%21Drupal%21Core%21StackMidd...
Shield module can use the ReverseProxyMiddleware::setSettingsOnRequest() function to address this issue, similar to what the core does.
For example, at line 431 in install.core.inc file.
https://git.drupalcode.org/project/drupal/-/blob/11.0.x/core/includes/in...
In order to make the Drupal reverse proxy setting work, you have to set reverse_proxy to TRUE.
Details on how to configuration a Drupal site for that see
https://www.drupal.org/docs/getting-started/installing-drupal/using-a-lo... →
N/A
N/A
N/A
Needs review
1.0
Code