title: Symfony fragments sometime return 403 to Varnish
body: <p>A Symfony 2.3 app is on a web server with nginx over port 80. Varnish4 is running on a front-end server on port 80 with Nginx on port 443 as an SSL terminator. This is also tested with Varnish3 with the same results. Mostly this works very well!</p>
  
  <p>After a few minutes some of the ESIs return a 403 Forbidden error with full Symfony template. I believe this is happening when cached fragments expire.</p>
  
  <p>I can force the issue by:</p>
  
  <ol>
  <li>Restarting Varnish to clear the cache</li>
  <li>Loading a page over HTTP (all OK)</li>
  <li>Loading the page over HTTPS (all OK)</li>
  <li>Waiting for some ESIs to expire from cache</li>
  <li>Loading the page over HTTPS (error happens here)</li>
  <li>Loading the page over HTTP (all OK)</li>
  </ol>
  
  <p>I can also force the issue by doing step 2 over HTTPS and step 5 over HTTP.</p>
  
  <p><strong>Therefore I believe the issue is related to the ESI protocol not matching the original page's protocol. Has anyone come across this problem before, or can help diagnose/fix?</strong></p>
  
  <p>Trusted proxies is the #1 culprit for 403 forbidden errors, but I have added <code>127.0.0.1</code> and the IP address of the front-end server to my trusted proxies list in <code>app/config/config.yml</code>. I can confirm things get far worse if I remove the trusted proxies list.</p>