123456789_123456789_123456789_123456789_123456789_

Class: Rack::Protection::IPSpoofing

Relationships & Source Files
Super Chains via Extension / Inclusion / Inheritance
Class Chain:
self, Base
Instance Chain:
self, Base
Inherits: Rack::Protection::Base
Defined in: rack-protection/lib/rack/protection/ip_spoofing.rb

Overview

Prevented attack

IP spoofing

Supported browsers

all

More infos

http://blog.c22.cc/2011/04/22/surveymonkey-ip-spoofing/

Detect (some) IP spoofing attacks.

Constant Summary

Base - Inherited

DEFAULT_OPTIONS

Class Method Summary

Base - Inherited

.default_options

Used by subclasses to declare default values for options they require.
.default_reaction

Used by subclasses to declare default reaction when a request is rejected.
.new

Instance Attribute Summary

Base - Inherited

#app, #options

Instance Method Summary

Base - Inherited

#accepts?, #call, #debug, #default_options,
#default_reaction

Alias for Base#deny.
#deny

Deny the request.
#drop_session, #encrypt, #html?, #instrument, #origin, #random_string, #react, #referrer,
#report

When used as a reaction (with option reaction: :report), any rejected request will be allowed through, and a warning is omitted (note that warnings will not be shown if the :logging option has been set to false).
#safe?, #secure_compare, #session, #session?, #warn

Constructor Details

This class inherits a constructor from Rack::Protection::Base

Instance Method Details

#accepts?(env) ⇒ Boolean

[ GitHub ] 

  


# File 'rack-protection/lib/rack/protection/ip_spoofing.rb', line 16



def accepts?(env)
  return true unless env.include? 'HTTP_X_FORWARDED_FOR'

  ips = env['HTTP_X_FORWARDED_FOR'].split(',').map(&:strip)
  return false if env.include?('HTTP_CLIENT_IP') && (!ips.include? env['HTTP_CLIENT_IP'])
  return false if env.include?('HTTP_X_REAL_IP') && (!ips.include? env['HTTP_X_REAL_IP'])

  true
end