CloudflareRails
This gem correctly configures Rails for CloudFlare so that request.remote_ip
/ request.ip
both work correctly. It also exposes a #cloudflare?
method on Rack::Request
.
Rails Compatibility
This gem requires railties
, activesupport
, and actionpack
>= 7.1
. For older rails
versions see the chart below:
rails version |
cloudflare-rails version |
---|---|
7.0 | 5.0.1 |
6.1 | 5.0.1 |
6.0 | 3.0.0 |
5.2 | 2.4.0 |
5.1 | 2.0.0 |
5.0 | 2.0.0 |
4.2 | 0.1.0 |
Installation
Add this line to your application's Gemfile
:
group :production do
# or :staging or :beta or whatever environments you are using cloudflare in.
# you probably don't want this for :test or :development
gem 'cloudflare-rails'
end
And then execute:
$ bundle
Problem
Using Cloudflare means it's hard to identify the IP address of incoming requests since all requests are proxied through Cloudflare's infrastructure. Cloudflare provides a CF-Connecting-IP header which can be used to identify the originating IP address of a request. However, this header alone doesn't verify a request is legitimate. If an attacker has found the actual IP address of your server they could spoof this header and masquerade as legitimate traffic.
cloudflare-rails
mitigates this attack by checking that the originating ip address of any incoming connection is from one of Cloudflare's ip address ranges. If so, the incoming X-Forwarded-For
header is trusted and used as the ip address provided to rack
and rails
(via request.ip
and request.remote_ip
). If the incoming connection does not originate from a Cloudflare server then the X-Forwarded-For
header is ignored and the actual remote ip address is used.
How it works
This code fetches and caches CloudFlare's current IPv4 and IPv6 lists. It then patches Rack::Request::Helpers
and ActionDispatch::RemoteIP
to treat these addresses as trusted proxies. The X-Forwarded-For
header will then be trusted only from those ip addresses.
Why not use config.action_dispatch.trusted_proxies
or Rack::Request.ip_filter?
By default Rails includes the ActionDispatch::RemoteIp middleware. This middleware uses a default list of trusted proxies. Any values from config.action_dispatch.trusted_proxies
are appended to this list. If you were to set config.action_dispatch.trusted_proxies
to the current list of Cloudflare IP addresses request.remote_ip
would work correctly.
Unfortunately this does not fix request.ip
. This method comes from the Rack::Request middleware. It has a separate implementation of trusted proxies and ip filtering. The only way to use a different implementation is to set Rack::Request.ip_filter
which expects a callable value. Providing a new one will override the old one so you'd lose the default values (all of which should be there). Those values aren't exported anywhere so your callable would now have to maintain that list on top of the Cloudflare IPs.
These issues are why this gem patches both Rack::Request::Helpers
and ActionDispatch::RemoteIP
rather than using the built-in configuration methods.
Prerequisites
You must have a cache_store
configured in your rails
application.
Usage
You can configure the HTTP timeout
and expires_in
cache parameters inside of your rails
config:
config.cloudflare.expires_in = 12.hours # default value
config.cloudflare.timeout = 5.seconds # default value
Blocking non-Cloudflare traffic
You can use the #cloudfront?
method from this gem to block all non-Cloudflare traffic to your application. Here's an example of doing this with Rack::Attack
:
Rack::Attack.blocklist('CloudFlare WAF bypass') do |req|
!req.cloudflare?
end
Note that the request may optionally pass through additional trusted proxies, so it will return true for any of these scenarios:
REMOTE_ADDR: CloudFlare
REMOTE_ADDR: trusted_proxy
,X_HTTP_FORWARDED_FOR: CloudFlare
REMOTE_ADDR: trusted_proxy
,X_HTTP_FORWARDED_FOR: trusted_proxy2,CloudFlare,...
but it will return false if CloudFlare comes after the trusted prefix of X-Forwarded-For
.
Alternatives
actionpack-cloudflare simpler approach using the CF-Connecting-IP
header.
Development
After checking out the repo, run bin/setup
to install dependencies. Then, run rake spec
to run the tests. You can also run bin/console
for an interactive prompt that will allow you to experiment.
To install this gem onto your local machine, run bundle exec rake install
. To release a new version, update the version number in version.rb
, and then run bundle exec rake release
, which will create a git tag for the version, push git commits and tags, and push the .gem
file to rubygems.org.
Contributing
Bug reports and pull requests are welcome on GitHub at https://github.com/modosc/cloudflare-rails.