rails/rails — Issue #5223: RemoteIp middleware trusted proxies config does not affect Rack::Request::trusted_proxy?
Author: courtland
Created: 2012-02-29 20:43:11+00:00
State: open

I have clients that connect to my rails app from a private IP address, where the clients real IP is presented to rails via the X-Forwarded-For header (Thin cluster behind a pound load balancer). By default, rails assumes these private addresses are "trusted proxies", which causes Request#remote_ip to return '127.0.0.1'.

This was somewhat addressed by pull request #2632 by making TRUSTED_PROXIES configurable in the RemoteIp Class.

However, Rails::Rack::Logger methods still call Rack::Request#ip which causes the IP address displayed in my logs to be 127.0.0.1.

Based on this change in rack: https://github.com/rack/rack/pull/192
It seems that ActionDispatch::Request should override Rack::Request#trusted_proxy? with the same "trusted proxies" that are configured for RemoteIp.

At the moment I have the following in an initializer to fix the problem for me, but it is obviously a really bad hack.
module Rack
class Request
def trusted_proxy?(ip)
ip =~ /^127\.0\.0\.1$/
end
end
end

Does anyone have comments or suggestions otherwise? I can attempt a patch if my logic seems sound. Thanks.