Enhance getServerName to prioritize and correctly parse forwarded headers for accurate server name resolution; add corresponding tests.

Author: c15k0

src/base/types/traits/Helper/ServerTrait.php

@@ -54,19 +54,78 @@ public function getTs($formatted = false)
      */
     public function getServerName()
     {
-        $serverName = $this->getServer('SERVER_NAME');
+        $serverName = $this->extractForwardedHost();
         if (empty($serverName)) {
-            $serverName = $this->getServer('HTTP_HOST');
+            $serverName = $this->extractHostFromValue((string)$this->getServer('HTTP_HOST', ''));
         }
-        $serverName = is_string($serverName) ? $serverName : '';
-        if (str_contains($serverName, ':')) {
-            $pieces = explode(':', $serverName);
-            $serverName = $pieces[0];
+        if (empty($serverName)) {
+            $serverName = $this->extractHostFromValue((string)$this->getServer('SERVER_NAME', ''));
         }
-        return true === in_array($serverName, ['0.0.0.0', '127.0.0.1', 'docker.host.internal']
+
+        return true === in_array(
+            strtolower($serverName),
+            ['0.0.0.0', '127.0.0.1', '::1', 'docker.host.internal'],
+            true
         ) ? 'localhost' : $serverName;
     }
 
+    /**
+     * @return string
+     */
+    private function extractForwardedHost(): string
+    {
+        $forwarded = trim((string)$this->getServer('HTTP_FORWARDED', ''));
+        if ($forwarded !== '') {
+            $entry = trim((string)explode(',', $forwarded)[0]);
+            if (preg_match('/(?:^|;)\\s*host\\s*=\\s*\"?([^\";]+)\"?/i', $entry, $matches) === 1) {
+                return $this->extractHostFromValue($matches[1]);
+            }
+        }
+
+        foreach (['HTTP_X_FORWARDED_HOST', 'HTTP_X_ORIGINAL_HOST', 'HTTP_X_HOST', 'HTTP_X_FORWARDED_SERVER'] as $header) {
+            $candidate = trim((string)$this->getServer($header, ''));
+            if ($candidate === '') {
+                continue;
+            }
+            $candidate = trim((string)explode(',', $candidate)[0]);
+            $host = $this->extractHostFromValue($candidate);
+            if ($host !== '') {
+                return $host;
+            }
+        }
+
+        return '';
+    }
+
+    /**
+     * @param string $value
+     * @return string
+     */
+    private function extractHostFromValue(string $value): string
+    {
+        $value = trim($value);
+        if ($value === '') {
+            return '';
+        }
+
+        $host = (string)parse_url($value, PHP_URL_HOST);
+        if ($host === '') {
+            $host = (string)parse_url('http://' . $value, PHP_URL_HOST);
+        }
+        if ($host !== '') {
+            return $host;
+        }
+
+        if (preg_match('/^\\[([0-9a-f:.]+)](?::\\d+)?$/i', $value, $matches) === 1) {
+            return $matches[1];
+        }
+        if (preg_match('/^([^:]+):\\d+$/', $value, $matches) === 1) {
+            return $matches[1];
+        }
+
+        return $value;
+    }
+
     /**
      * @return string
      */

tests/base/RequestTest.php

@@ -113,6 +113,30 @@ public function testRootUrlOmitsStandardPorts(): void
         $this->assertSame('https://secure.example.org', $request->getRootUrl());
     }
 
+    public function testGetServerNamePrioritizesForwardedHeaders(): void
+    {
+        $request = Request::getInstance();
+        $request->setServer([
+            'SERVER_NAME' => 'internal.local',
+            'HTTP_HOST' => 'internal.local:8080',
+            'HTTP_X_FORWARDED_HOST' => 'public.example.com:443, edge.local',
+        ]);
+
+        $this->assertSame('public.example.com', $request->getServerName());
+    }
+
+    public function testGetServerNameParsesForwardedHeader(): void
+    {
+        $request = Request::getInstance();
+        $request->setServer([
+            'SERVER_NAME' => 'internal.local',
+            'HTTP_HOST' => 'internal.local',
+            'HTTP_FORWARDED' => 'for=203.0.113.60;proto=https;host="api.example.com:8443"',
+        ]);
+
+        $this->assertSame('api.example.com', $request->getServerName());
+    }
+
     public function testFileDetectionAndLanguageHeaderAndTimestamp(): void
     {
         $request = Request::getInstance();