facebook/facebook-php-sdk — pull request #114 by moisadoru (2013-11-01 23:21:36+00:00)
Title: Support for multiple chained forward proxies in getHttpUrl()

When the application that uses the Facebook PHP SDK is behind 2 or more forward proxies, the **X-Forwarded-Host** header contains a comma separated list of hosts (each proxy appends a comma and its own hostname).

For example, if we have this chain:
```
Client
|
Fwd Proxy1 (first.proxy)
|
Fwd Proxy2 (second.proxy )
|
Application (third.server)
```
Then we will have these values for a script executed on third.server:

```php
$_SERVER['HTTP_X_FORWARDED_HOST'] = 'first.proxy, second.proxy';
$_SERVER['HTTP_HOST'] = 'third.server';
```

If we use the raw value from **$_SERVER['HTTP_X_FORWARDED_HOST']** for composing return URLs, we will generate invalid return URLs, in our case: **[http://first.proxy, second.proxy/fb_oauth.php](http://first.proxy, second.proxy/fb_oauth.php)**, and of course, we get a **'Oauth exception 191'** or some other error message.

If we properly process the X-Forwarded-Host value by taking the **leftmost** host, we will not get errors.
To test this, you can simulate the setup locally with Apache and mod_proxy/mod_proxy_http:
1. Add '127.0.0.1 first.proxy second.proxy third.server' to your /etc/hosts
2. Setup the vhosts:
```

ServerName first.proxy
ProxyPass / http://second.proxy/
ProxyPassReverse / http://second.proxy/

ServerName second.proxy
ProxyPass / http://third.server/
ProxyPassReverse / http://third.server/

ServerName third.server
DocumentRoot /var/www

```
3. Add a php script to check the headers (/var/www/check.php):
```php

$> curl http://first.proxy/fwd.php
Acccessed using 'first.proxy', taken from the X-Forwarded-Host header 'first.proxy, second.proxy'
$> curl http://second.proxy/fwd.php
Acccessed using 'second.proxy', taken from the X-Forwarded-Host header 'second.proxy'
$> curl http://third.server/fwd.php
Acccessed using 'third.server', taken from the Host header (no forward proxy).

As you can see, when accessing the script through at least two forward proxies, the X-Forwarded-Host header dows not contain a single URL, but multiple comma separated URLs.