如何在Rails 4應用程序中禁用IP欺騙檢查？

Question

我發現了以下錯誤在我的Rails應用4：

ActionDispatch::RemoteIp::IpSpoofAttackError: IP spoofing attack?! HTTP_CLIENT_IP="xx.xx.xx.xx" HTTP_X_FORWARDED_FOR="xx.xx.xx.xx"

我們不需要這種類型的安全檢查，因此一些周圍的Googling後，我發現這一點：

https://github.com/rails/rails/issues/10780

When an intermediate proxy inserts the user IP address both in the HTTP_CLIENT_IP and the HTTP_X_FORWARDED_FOR, and this address is private, ActionDispatch::RemoteIp raises an IpSpoofAttackError exception.

When an enterprise proxy includes the user's IP address in a header, this will commonly be private. Removing private IP addresses from the chain contained in HTTP_X_FORWARDED_FOR should probably be done only when the address is not an exact match of the one found in HTTP_CLIENT_IP. If it is a match, that should be the user's IP address.

This happens for example with the following environment:

HTTP_CLIENT_IP: 172.17.19.51 HTTP_X_BLUECOAT_VIA: ffffffffffffffff HTTP_X_FORWARDED_FOR: 172.17.19.51 REMOTE_ADDR: xxx.xxx.xxx.xxx (this would be a public IP address)

---

一個修復這裏介紹：

As a work-around, I've disabled this check in config/application.rb:

config.action_dispatch.ip_spoofing_check = false

然而，這似乎並沒有在Rails 4中工作。什麼是新的電話，我如何設置它的網站範圍？

Answer 1

config.action_dispatch.ip_spoofing_check應該工作基於calling chain爲RemoteIp。

您應該能夠通過將config.action_dispatch.trusted_proxies設置爲regex matching all IPv4 addresses來實現相同的效果。

Answer 2

而不是關閉警告，它可能會更好地解決實際問題。這是我對Rails告訴你的改寫：

This request seems to have come through two different reverse proxies. One of them set the CLIENT_IP header to the user's IP address; the other set the X_FORWARDED_FOR header. One of those values is probably correct, the other probably contains the IP of a reverse proxy, and I have no way to tell which is which. I can't reliably determine this user's IP address, so I'm going to reject the request.

「正確的」解決方案是停止設置兩個標頭。爲此，您需要追蹤他們來自哪裏（我會從您的Bluecoat設備開始），並確定它們是否都需要。通常你只會使用其中一個。

如果事實證明它們都是需要的（我見過很奇怪的東西），那麼你需要找出哪個頭被首先設置（假設鏈中有兩個代理）。然後，您可以編寫一個自定義中間件來刪除其他HTTP標頭。

有關如何創建自己的中間件的指示信息，請參閱Rails 3 middleware modify request headers。將它插入RemoteIp中間件之前，清除哪個標頭具有「壞」值，並且您應該很好。