提交 c9d8481b 编写于 作者: R Rafael Mendonça França

Merge pull request #8706 from steveklabnik/ip_precautions

Explain the possible IP precautions
......@@ -17,9 +17,10 @@ module ActionDispatch
# IF YOU DON'T USE A PROXY, THIS MAKES YOU VULNERABLE TO IP SPOOFING.
# This middleware assumes that there is at least one proxy sitting around
# and setting headers with the client's remote IP address. If you don't use
# a proxy, because you are hosted on e.g. Heroku, any client can claim to
# have any IP address by setting the X-Forwarded-For header. If you care
# about that, please take precautions.
# a proxy, because you are hosted on e.g. Heroku without SSL, any client can
# claim to have any IP address by setting the X-Forwarded-For header. If you
# care about that, then you need to explicitly drop or ignore those headers
# sometime before this middleware runs.
class RemoteIp
class IpSpoofAttackError < StandardError; end
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册