Rails Ruby on Rails

ActionDispatch:RemoteIp ignores X-Forwarded-For if all of the IPs it contains are considered trusted proxies. This list includes localhost and all private addresses.

This impacts applications that are hosted behind a reverse proxy (proxying to localhost) and accessed from a private IP, such as intranet applications. Aside from making the remote ip detection incorrect, this causes problems with ActionDispatch::Request.local?, causing it to incorrectly return true, which in turn causes default configurations of Rails apps to show stack traces when they shouldn't.

The offending line appears to be here: https://github.com/rails/rails/blob/master/actionpack/lib/action_di...

Perhaps it should fall back to the last ip in the forwarded for chain instead:

return forwarded_ips.reject { |ip| ip =~ @trusted_proxies }.last || forwarded_ips.last