Cloudflare Real IP

A free add-on for Concrete CMS 9.5 that makes a site behind Cloudflare see each visitor's real address, so editors stop being logged out on every save. It fills in Concrete's own Trusted Proxies setting with Cloudflare's published ranges, keeps the list current on a schedule, and shows you whether the fix is working. MIT licensed. No root needed, nothing to configure.

---

The problem it fixes

Concrete drops a session when the visitor's IP address changes between requests. Behind Cloudflare's proxy, every request reaches the server from a different Cloudflare edge address, so the first Dashboard save bounces to the login page and logging in again fails with "Invalid form token". Concrete already has the setting that fixes this, under System & Settings → Permissions & Access → Trusted Proxies. Filling it in by hand means pasting 22 ranges, ticking the right two headers, and remembering to come back when Cloudflare changes the list.

What it does

• Adds Cloudflare's IPv4 and IPv6 ranges to the core's trusted proxies list on install, keeping any ranges you already had there, and trusts the X-Forwarded-For and X-Forwarded-Proto headers Cloudflare sends. It writes to the same place the core's Trusted Proxies page does, so that page shows exactly what is trusted and you can still add your own.
• Registers one Automation task, Refresh Cloudflare IP Ranges, which fetches the live list from Cloudflare, validates every entry, and updates the setting when something changed. Schedule it weekly; Cloudflare changes its ranges a few times a year. The same task runs from the command line as concrete task:cloudflare-refresh-ranges.
• Adds a Dashboard page next to Trusted Proxies that reads the current request and reports one of three states: Working (Concrete sees the address from Cloudflare's CF-Connecting-IP header), Not working with the reason, or Not behind Cloudflare. That page replaces reading the access log.

A refresh that comes back empty, malformed, or missing more than half the ranges is refused and the previous list stays. The add-on ships with a copy of the list and the date it was taken, so it works before the first refresh and on a server with no outbound access.

Install it

Drop the c5studio_cloudflare folder into packages/, then install it under Extend Concrete in the Dashboard, or from the command line:

./vendor/bin/concrete c5:package:install c5studio_cloudflare

Installing applies the list straight away. Then open System & Settings → Permissions & Access → Cloudflare Real IP from the proxied domain and check that it says Working.

Uninstall

Uninstalling removes the ranges the add-on added and nothing else. Ranges you added yourself stay, and so do the header flags while any range remains. If nothing is left, the setting is cleared.

If you have root

An Nginx real_ip rule does the same job one layer earlier and for every application on the box. The self-hosting guide has the rule. The add-on is for the more common case where you do not have root, or would rather not edit Nginx, and its status page is useful either way: with the Nginx rule in place it reports that the web server restored the address.

Before this add-on

The concretecms/cloudflare_proxy package from 2017 solved the same problem by setting the proxies at runtime from a command-line tool. It was never published to the marketplace and has not been released since. This add-on takes the Dashboard route instead: it writes to the core setting so the Trusted Proxies page stays the source of truth, adds the scheduled refresh and the status check, and is being submitted to the marketplace. The version number stays at 0.9 until that review finishes; the package itself is complete.