alphagov/static — pull request #470 by fatbusinessman (2014-10-15 14:50:33+00:00)
Title: Strip out the `Client-IP` header

We don't use this header anywhere in our stack, using `X-Forwarded-For` instead. If a request comes in with both headers set, and they don't match, Rails will take this as evidence that someone is trying to spoof their IP address to gain unauthorised access to something.

We could disable this check with a configuration change (see [an example in Signon](https://github.com/alphagov/signonotron2/blob/a4c4c4ecc73a/config/application.rb#L64-69)), but it's less likely to lead to bugs elsewhere in the app if we strip out the `Client-IP` header entirely. It's also simpler, because it just requires a single line in the `Gemfile` and doing the dance of Bundler.