"IP spoofing attack" breaks with some proxies

I have the same problem.

I think is a bug, since http://en.wikipedia.org/wiki/X-F... says that the first element of HTTP_X_FORWARDED_FOR must be the same of HTTP_CLIENT_IP

The actual code is:

  if @env.include? 'HTTP_CLIENT_IP'
    if remote_ips && !remote_ips.include?(@env['HTTP_CLIENT_IP'])
      # We don't know which came from the proxy, and which from the user
      raise ActionControllerError.new(<<EOM)

IP spoofing attack?! HTTP_CLIENT_IP=#{@env['HTTP_CLIENT_IP'].inspect} HTTP_X_FORWARDED_FOR=#{@env['HTTP_X_FORWARDED_FOR'].inspect} EOM

    end

    return @env['HTTP_CLIENT_IP']
  end

And i think it must be something like these

  if @env.include? 'HTTP_CLIENT_IP'
    if remote_ips && @env['HTTP_CLIENT_IP'].strip != remote_ips[0]

...

I have the same problem.

I think is a bug, since http://en.wikipedia.org/wiki/X-F... says that the first element of HTTP_X_FORWARDED_FOR must be the same of HTTP_CLIENT_IP

The actual code is:

  if @env.include? 'HTTP_CLIENT_IP'
    if remote_ips && !remote_ips.include?(@env['HTTP_CLIENT_IP'])
      # We don't know which came from the proxy, and which from the user
      raise ActionControllerError.new(<<EOM)

IP spoofing attack?! HTTP_CLIENT_IP=#{@env['HTTP_CLIENT_IP'].inspect} HTTP_X_FORWARDED_FOR=#{@env['HTTP_X_FORWARDED_FOR'].inspect} EOM

    end

    return @env['HTTP_CLIENT_IP']
  end

And i think it must be something like these

  if @env.include? 'HTTP_CLIENT_IP'
    if remote_ips && @env['HTTP_CLIENT_IP'].strip != remote_ips[0]

...

I think the issue with the IP Spoofing Check as it exists in the current code is that it assumes the client actually has an IP address. On Cell networks, this isn't the case. Expecting to get Cell companies to set non-standard headers properly is a leap of faith (IMHO).

I have little issue with the keeping the spoofing check, as it seems reasonable for proxy administrators to configure their proxies in a reasonable matter. However, there are real issues when this check causes a lot of false positives.

I have no real numbers from our own site, but I believe we see the majority of our requests from mobile devices fail this check, when it's left in place. In this case, being able to simply turn this check off would be useful (and we have simply commented out the check for the last couple releases of Rails).

I've attached a patch, which I think is a reasonable change to allow people who want to avoid this check to turn it off. This is my first patch, and I apologize if I failed protocol. I am expecting at least some feedback (I'm not sure if I put the configurable property in the right place, and there should be more docs).

(from [0a4a5f3129a137fc357e8444a08b135f0ad4fbe8]) Making the IP Spoofing check in AbstractRequest#remote_ip configurable.

Certain groups of web proxies do not set these values properly. Notably, proxies for cell phones, which often do not set the remote IP information correctly (not surprisingly, since the clients do not have an IP address).

Allowing this to be configurable makes it possible for developers to choose to ignore this simple spoofing check, when a significant amount of their traffic would result in false positives anyway.

Signed-off-by: Michael Koziarski michael@koziarski.com

[#1200 "IP spoofing attack" breaks with some proxies state:committed] http://github.com/rails/rails/co...