From fbdfbe954e49b66149d6fb2d8f548544ed6ff369 Mon Sep 17 00:00:00 2001 From: Zsolt Tasnadi Date: Tue, 25 Aug 2026 15:00:38 +0200 Subject: [PATCH] X-Forwarded-For fix 2 --- apps/api/config/application.rb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/apps/api/config/application.rb b/apps/api/config/application.rb index e898c47..fe098eb 100644 --- a/apps/api/config/application.rb +++ b/apps/api/config/application.rb @@ -24,9 +24,12 @@ module Api config.action_controller.forgery_protection_origin_check = false + # nginx → Traefik → Rails proxy chain: trust Docker + loopback ranges + # so request.remote_ip reads the real client IP from X-Forwarded-For config.action_dispatch.trusted_proxies = ActionDispatch::RemoteIp::TRUSTED_PROXIES + [ IPAddr.new("172.16.0.0/12"), - IPAddr.new("10.0.0.0/8") + IPAddr.new("10.0.0.0/8"), + IPAddr.new("192.168.0.0/16") ] config.autoload_lib(ignore: %w[assets tasks])