rails/rails — Issue #4962: Actionpack 3.2.1 regression: client can fake request.remote_ip
Author: andreas-s
Created: 2012-02-09 12:02:10+00:00
State: open

A client that accesses a Rails app without a proxy that overwrites headers can make request.remote_ip return arbitrary strings (!) by setting the header X-Forwarded-For. This is a regression from 3.1.

Source of the problem: remote_ip always gives the headers preference over the actual connection IP (REMOTE_ADDR).

https://github.com/rails/rails/blob/master/actionpack/lib/action_dispatch/middleware/remote_ip.rb:

```ruby
def calculate_ip
client_ip = @env['HTTP_CLIENT_IP']
forwarded_ips = ips_from('HTTP_X_FORWARDED_FOR')
remote_addrs = ips_from('REMOTE_ADDR')

### irrelevant code snipped ###

not_proxy = client_ip || forwarded_ips.first || remote_addrs.first

# Return first REMOTE_ADDR if there are no other options
not_proxy || ips_from('REMOTE_ADDR', :allow_proxies).first
end
```