rails/rails — Issue #5224: Production Rails application behind load balancer sees requests as coming from localhost, displays development error messages (security risk)
Author: lawso017
Created: 2012-03-01 05:01:23+00:00
State: open

Rails 3.1.3 app in production is displaying development error messages when deployed behind a Rackspace Cloud Load Balancer.

Have confirmed that this behavior is due to traffic from the load balancer appearing to originate on localhost from the server's perspective.

Would recommend reverting the "magic" inference of Rails deciding if a request is local based upon IP address, thus ignoring the explicit config setting of config.consider_all_requests_local = false

Displaying development errors in production is potential security issue, and the inferential behavior overriding a specific, explicit setting does not follow the principle of least surprise.

Have patched based upon this:
http://helderribeiro.net/?p=357

But would prefer that consider_all_requests_local flag be respected.

Thanks for considering this issue.