diff --git a/config/packages/framework.yaml b/config/packages/framework.yaml
index 9ef7c1f9..f4039501 100644
--- a/config/packages/framework.yaml
+++ b/config/packages/framework.yaml
@@ -4,6 +4,15 @@ framework:
     csrf_protection: true
     http_method_override: false
 
+    # Allow users to configure trusted hosts via .env variables
+    # see https://symfony.com/doc/current/reference/configuration/framework.html#trusted-hosts
+    trusted_hosts: '%env(TRUSTED_HOSTS)%'
+
+    # Allow users to configure reverse proxies via .env variables. Default values are defined in parameters.yaml.
+    trusted_proxies: '%env(TRUSTED_PROXIES)%'
+    # Trust all headers by default. X-Forwared-Host can be a security risk if your reverse proxy doesn't set it.
+    trusted_headers: ['x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-forwarded-port', 'x-forwarded-prefix']
+
     # Enables session support. Note that the session will ONLY be started if you read or write from it.
     # Remove or comment this section to explicitly disable session support.
     session:
diff --git a/config/parameters.yaml b/config/parameters.yaml
index e4690ec9..9ca1a48d 100644
--- a/config/parameters.yaml
+++ b/config/parameters.yaml
@@ -50,4 +50,5 @@ parameters:
   env(DEMO_MODE): 0
   env(ALLOW_ATTACHMENT_DOWNLOADS): 0
 
-
+  env(TRUSTED_PROXIES): '127.0.0.1' #By default trust only our own server
+  env(TRUSTED_HOSTS): '' # Trust all host names by default