lib/action_dispatch/middleware/remote_ip.rb in actionpack-4.0.0 vs lib/action_dispatch/middleware/remote_ip.rb in actionpack-4.0.1.rc1

@@ -141,10 +141,10 @@
         # +Client-Ip+ and +X-Forwarded-For+ should not, generally, both be set.
         # If they are both set, it means that this request passed through two
         # proxies with incompatible IP header conventions, and there is no way
         # for us to determine which header is the right one after the fact.
         # Since we have no idea, we give up and explode.
-        should_check_ip = @check_ip && client_ips.last
+        should_check_ip = @check_ip && client_ips.last && forwarded_ips.last
         if should_check_ip && !forwarded_ips.include?(client_ips.last)
           # We don't know which came from the proxy, and which from the user
           raise IpSpoofAttackError, "IP spoofing attack?! " +
             "HTTP_CLIENT_IP=#{@env['HTTP_CLIENT_IP'].inspect} " +
             "HTTP_X_FORWARDED_FOR=#{@env['HTTP_X_FORWARDED_FOR'].inspect}"