Skip to content

docs: document HTTP request filtering differences - #2561

Merged
dunglas merged 3 commits into
php:mainfrom
ousamabenyounes:docs/issue-2521-request-differences
Sep 17, 2026
Merged

dunglas merged 3 commits into
php:mainfrom
ousamabenyounes:docs/issue-2521-request-differences

Conversation

@ousamabenyounes

@ousamabenyounes ousamabenyounes commented Jul 26, 2026 •

Copy link
Copy Markdown
Contributor

Fix #2521.

Changes

  • Document request-filtering differences to check when migrating from Nginx or Apache plus PHP-FPM.
  • Add a TRACE method example showing how to reject it explicitly in the Caddyfile before php_server.
  • Mention that stricter header-name filtering may also need to be enforced by the Caddyfile or another proxy when migrating.
  • Keep FrankenPHP's default behavior unchanged.

Validation

Verified with Docker using dunglas/frankenphp:1.12.6-php8.5 and a PHP script that prints the request method and incoming HTTP_X_* server variables.

Default Caddyfile:

GET /index.php      -> 200, method=GET
TRACE /index.php    -> 200, method=TRACE
special header name -> passed to PHP as HTTP_X_SPECIAL!#$%&*+_^|~

With the documented matcher:

GET /index.php      -> 200, method=GET
TRACE /index.php    -> 405
special header name -> still passed to PHP unless filtered separately

Also ran git diff --check.

@ousamabenyounes
ousamabenyounes force-pushed the docs/issue-2521-request-differences branch from 7a8c599 to 7d5ca2f Compare August 16, 2026 16:52
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@dunglas
dunglas merged commit 5a58690 into php:main Sep 17, 2026
2 checks passed
@dunglas

dunglas commented Sep 17, 2026

Copy link
Copy Markdown
Member

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Should FrankenPHP reject TRACE requests in the default configuration?

2 participants