aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack/lib/action_dispatch/middleware/remote_ip.rb
Commit message (Collapse)AuthorAgeFilesLines
* Explain the possible precautionsAndre Arko2013-01-021-3/+4
|
* Restore original remote_ip algorithm.Andre Arko2013-01-021-53/+112
| | | | | | | | | | | Proxy servers add X-Forwarded-For headers, resulting in a list of IPs. We remove trusted IP values, and then take the last given value, assuming that it is the most likely to be the correct, unfaked value. See [1] for a very thorough discussion of why that is the best option we have at the moment. [1]: http://blog.gingerlime.com/2012/rails-ip-spoofing-vulnerabilities-and-protection/ Fixes #7979
* memoize calculated ip without additional variableSergey Nartimov2012-11-011-6/+4
| | | | There is no need in additional `@calculated_ip` instance variable.
* Valid ips v4 and v6. Right logic for working with X-FORWARDED-FOR header and ↵Alexey Gaziev2012-04-251-22/+68
| | | | tests.
* Merge pull request #2490 from gsterndale/x_forwarded_for_orderJosé Valim2012-02-071-1/+1
|\ | | | | The first IP address in the X-Forwarded-For header is the originating IP
| * The first IP address in the X-Forwarded-For header is the originating IPGreg Sterndale2012-02-071-1/+1
| |
* | Trusted proxies is replaced with a Regexp or appended to with a StringGreg Sterndale2012-02-071-4/+6
|/
* Fix routing test to use assert_equalCarlos Antonio da Silva2012-01-061-2/+2
|
* It should be @calculated_ip not @calculate_ipArun Agrawal2011-11-171-1/+1
| | | | We are using @calculated_ip. @calculate_ip is no where used
* Initialize our instance variables.Aaron Patterson2011-11-161-1/+3
|
* :facepalm: Request#remote_ip has to work without the middlewareAndre Arko2011-11-161-1/+1
|
* Revert "Revert "Merge pull request #3640 from indirect/remote_ip""Andre Arko2011-11-161-3/+6
| | | | This reverts commit 8d1a2b3ecde5a8745b3eaab4763a71d80ca3441f, because I have fixed the issues this commit caused in the next commit.
* Revert "Merge pull request #3640 from indirect/remote_ip"Jon Leighton2011-11-151-6/+3
| | | | | | | | This reverts commit 6491aadc525b8703708e0fd0fbf05bd436a47801, reversing changes made to 83bf0b626cf2134260903e57d74f67de57384073. See https://github.com/rails/rails/pull/3640#issuecomment-2752761 for explanation.
* GetIp#to_s should never return nil. That's icky.Andre Arko2011-11-141-3/+6
|
* memoize the relatively expensive remote IP codeAndre Arko2011-11-141-1/+7
|
* cleaner namesAndre Arko2011-11-141-6/+6
|
* remove ignored flag, fixes warningsAndre Arko2011-11-131-1/+1
|
* turns out the tests expect remote_addrs.firstAndre Arko2011-11-131-1/+1
|
* correctly raise IpSpoofAttackError messageAndre Arko2011-11-131-2/+2
|
* defer calculating the remote IP until requestedAndre Arko2011-11-121-24/+36
|
* refactor RemoteIp middlewareAndre Arko2011-11-111-37/+44
| | | | | | | | | | | - return the last forwarded IP before REMOTE_ADDR to handle proxies - remove completely superfluous RemoteIpGetter class - remove duplication of trusted proxies regexp - remove unused constant from Request - move comments from Request to where they are actually relevant - edit comments for clarity of purpose The original code (confusingly) tried to return REMOTE_ADDR both at the beginning and the end of the chain of options. Since REMOTE_ADDR is _always_ set, this is kind of silly. This change leaves REMOTE_ADDR as the last option, so that proxied requests will be assigned the correct remote IP address.
* Move remote_ip to a middleware:Carlhuda2010-03-031-0/+51
* ActionController::Base.ip_spoofing_check deprecated => config.action_dispatch.ip_spoofing_check * ActionController::Base.trusted_proxies deprecated => config.action_dispatch.trusted_proxies