Last active
November 21, 2023 14:06
-
-
Save mudge/e5c72d701d7fcbda67608deb800193cb to your computer and use it in GitHub Desktop.
How to configure Rails and Rack::Attack to use the real client IP when running behind Cloudflare
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Rails.application.configure do | |
# Add Cloudflare's IPs to the trusted proxy list so they are ignored when | |
# determining the true client IP. | |
# | |
# See https://www.cloudflare.com/ips-v4/ and https://www.cloudflare.com/ips-v6/ | |
config.action_dispatch.trusted_proxies = ActionDispatch::RemoteIp::TRUSTED_PROXIES + %w[ | |
173.245.48.0/20 | |
103.21.244.0/22 | |
103.22.200.0/22 | |
103.31.4.0/22 | |
141.101.64.0/18 | |
108.162.192.0/18 | |
190.93.240.0/20 | |
188.114.96.0/20 | |
197.234.240.0/22 | |
198.41.128.0/17 | |
162.158.0.0/15 | |
104.16.0.0/13 | |
104.24.0.0/14 | |
172.64.0.0/13 | |
131.0.72.0/22 | |
2400:cb00::/32 | |
2606:4700::/32 | |
2803:f800::/32 | |
2405:b500::/32 | |
2405:8100::/32 | |
2a06:98c0::/29 | |
2c0f:f248::/32 | |
].map { |proxy| IPAddr.new(proxy) } | |
end |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Rack::Attack.throttle("req/ip", limit: 300, period: 5.minutes) do |req| | |
req.get_header("action_dispatch.remote_ip") unless req.path.start_with?("/assets") | |
end |
Ah yes, I do something similar via:
blocklist("herokuapp") do |req|
req.host =~ /herokuapp/
end
...which works for my case, simply enforcing access through my domain as opposed to Heroku directly.
Thanks for sharing!
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
True. We're actually running on Heroku, at the moment 😅
The gem's test suite looked solid to me to use a gem, and monkey patching, rather than having to manage this functionality on our own.
Talking about Cloudflare, Heroku, and Rack::Attack. We use this Rack::Attack configuration to prevent skipping Cloudflare in production. May be helpful for you or others who get here.