lib/action_dispatch/middleware/remote_ip.rb in actionpack-7.2.1.2 vs lib/action_dispatch/middleware/remote_ip.rb in actionpack-7.2.2

- old
+ new

@@ -16,12 +16,12 @@ # # Some Rack servers concatenate repeated headers, like [HTTP RFC # 2616](https://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2) requires. # Some Rack servers simply drop preceding headers, and only report the value # that was [given in the last - # header](https://andre.arko.net/2011/12/26/repeated-headers-and-ruby-web-server - # s). If you are behind multiple proxy servers (like NGINX to HAProxy to + # header](https://andre.arko.net/2011/12/26/repeated-headers-and-ruby-web-servers). + # If you are behind multiple proxy servers (like NGINX to HAProxy to # Unicorn) then you should test your Rack server to make sure your data is good. # # IF YOU DON'T USE A PROXY, THIS MAKES YOU VULNERABLE TO IP SPOOFING. This # middleware assumes that there is at least one proxy sitting around and setting # headers with the client's remote IP address. If you don't use a proxy, because @@ -115,13 +115,12 @@ # an `X-Forwarded-For` header. If there are multiple proxies, that header may # contain a list of IPs. Other proxy services set the `Client-Ip` header # instead, so we check that too. # # As discussed in [this post about Rails IP - # Spoofing](https://web.archive.org/web/20170626095448/https://blog.gingerlime.c - # om/2012/rails-ip-spoofing-vulnerabilities-and-protection/), while the first IP - # in the list is likely to be the "originating" IP, it could also have been set - # by the client maliciously. + # Spoofing](https://web.archive.org/web/20170626095448/https://blog.gingerlime.com/2012/rails-ip-spoofing-vulnerabilities-and-protection/), + # while the first IP in the list is likely to be the "originating" IP, it + # could also have been set by the client maliciously. # # In order to find the first address that is (probably) accurate, we take the # list of IPs, remove known and trusted proxies, and then take the last address # left, which was presumably set by one of those proxies. def calculate_ip