ruby-on-rails – 如何在Rails 4应用程序中禁用IP Spoofing检查？

我在Rails 4应用程序上遇到以下错误：

Actiondispatch::RemoteIp::IpSpoofAttackerror: IP spoofing attack?! HTTP_CLIENT_IP=”xx.xx.xx.xx” HTTP_X_FORWARDED_FOR=”xx.xx.xx.xx”

我们不需要这种类型的安全检查,所以经过一些谷歌搜索我发现：

https://github.com/rails/rails/issues/10780

When an intermediate proxy inserts the user IP address both in the
HTTP_CLIENT_IP and the HTTP_X_FORWARDED_FOR,and this address is
private,Actiondispatch::RemoteIp raises an IpSpoofAttackerror
exception.

When an enterprise proxy includes the user’s IP address in a header,
this will commonly be private. Removing private IP addresses from the
chain contained in HTTP_X_FORWARDED_FOR should probably be done only
when the address is not an exact match of the one found in
HTTP_CLIENT_IP. If it is a match,that should be the user’s IP
address.

This happens for example with the following environment:

HTTP_CLIENT_IP: 172.17.19.51 HTTP_X_BLUECOAT_VIA: ffffffffffffffff
HTTP_X_FORWARDED_FOR: 172.17.19.51 REMOTE_ADDR: xxx.xxx.xxx.xxx (this
would be a public IP address)

这里有一个修复：

As a work-around,I’ve disabled this check in config/application.rb:

config.action_dispatch.ip_spoofing_check = false

然而,这似乎不适用于Rails 4.什么是新的调用,如何在网站范围内设置它？

解决方法

不是关闭警告,而是解决实际问题可能更好.这是我对Rails告诉你的内容的改述：

This request seems to have come through two different reverse proxies. One of them set the CLIENT_IP header to the user’s IP address; the other set the X_FORWARDED_FOR header. One of those values is probably correct,the other probably contains the IP of a reverse proxy,and I have no way to tell which is which. I can’t reliably determine this user’s IP address,so I’m going to reject the request.

“正确”的解决方案是停止设置两个标题.为此,你需要追踪他们来自哪里(我从你的Bluecoat设备开始)并找出他们是否都需要.通常你只会使用其中一个.

如果事实证明它们都是需要的(我已经看到了陌生的东西),那么你需要找出首先设置哪个头(假设链中有两个代理).然后,您可以编写一个删除其他HTTP标头的自定义中间件.

有关如何创建自己的中间件的指示,请参阅Rails 3 middleware modify request headers.在RemoteIp中间件之前插入它,清除哪个标题有“坏”值,你应该是好的.