This project is archived and is in readonly mode.

#3257 ✓resolved
Christopher Owen

[PATCH] local_request? does not detect local IPv6 connections

Reported by Christopher Owen | September 25th, 2009 @ 02:13 AM | in 3.0.2

When deciding how to handle server exceptions, the implementation of ActionDispatch::ShowExceptions#local_request? tries to match the request IP address to '127.0.0.1'. This approach does not consider IPv6 loopback connections (from ::1) to be local.

The main ramification is that when developing locally against a rails environment where config.action_controller.consider_all_requests_local is false, local connections from 127.0.0.1 still exhibit development error view rendering, whereas connections from ::1 use production error rendering.

This can be confusing when looking at an error using Safari, which uses the IPv6 interface if available, versus Firefox which uses the IPv4 loopback interface. Safari will render the non-local error view while FF will use the local/development view.

I've attached a patch and test for a version of local_request? that identifies all connections from a loopback address. It also uses a strictly precise definition for IPv4 connections such that any request from the 127.0.0.0/8 subnet is considered local. I'm a little concerned that such a precise treatment could have unintended consequences in a production environment -- I'd welcome any discussion in that regard.

Comments and changes to this ticket

Create your profile

Help contribute to this project by taking a few moments to create your personal profile. Create your profile »

<h2 style="font-size: 14px">Tickets have moved to Github</h2>

The new ticket tracker is available at <a href="https://github.com/rails/rails/issues">https://github.com/rails/rails/issues</a>

Referenced by

Pages