Class: Otto::Security::Middleware::IPPrivacyMiddleware

Inherits:
Object
  • Object
show all
Defined in:
lib/otto/security/middleware/ip_privacy_middleware.rb

Overview

IP Privacy Middleware

Automatically masks IP addresses for privacy by default. Original IPs are never stored unless privacy is explicitly disabled.

Otto pins this middleware to the OUTERMOST position of the stack (the :entrypoint tier — see Otto::Core::MiddlewareStack#add_with_position), so it is the first middleware to touch a request and every other middleware, plus the application, reads masked IPs by default. Before #219 it was registered position: :first, which is first-in-array and therefore INNERMOST: only the wrapped app saw masked values while every other middleware still saw the raw peer address.

Because it now runs ahead of everything, facts about the ORIGINAL peer that downstream code can no longer derive from the (masked) REMOTE_ADDR are recorded first, as leak-free booleans — never as addresses: env[‘otto.via_trusted_proxy’] and env[‘otto.peer_loopback’].

Examples:

Default behavior (privacy enabled)

# env['REMOTE_ADDR'] is masked to 192.168.1.0
# env['otto.privacy.fingerprint'] contains full anonymized data
# env['otto.original_ip'] is NOT set

Privacy disabled

otto.disable_ip_privacy!
# env['REMOTE_ADDR'] contains real IP
# env['otto.original_ip'] also contains real IP

Instance Method Summary collapse

Constructor Details

#initialize(app, security_config = nil) ⇒ IPPrivacyMiddleware

Initialize IP Privacy middleware

Parameters:



41
42
43
44
45
 
# File 'lib/otto/security/middleware/ip_privacy_middleware.rb', line 41

def initialize(app, security_config = nil)
  @app = app
  @security_config = security_config
  @config = security_config&.ip_privacy_config || Otto::Privacy::Config.new
end

Instance Method Details

#call(env) ⇒ Array

Process request with IP privacy

Parameters:

  • env (Hash) —

    Rack environment

Returns:

  • (Array) —

    Rack response tuple [status, headers, body]



51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
 
# File 'lib/otto/security/middleware/ip_privacy_middleware.rb', line 51

def call(env)
  # Idempotency: if a prior IPPrivacyMiddleware pass already resolved the
  # canonical client IP for this request, do not re-resolve or re-mask.
  # This makes stacking two instances (e.g. an app-level mount plus
  # Otto's built-in router mount) order-safe instead of double-masking.
  if env.key?('otto.client_ip')
    ensure_ip_match_present(env)
    return @app.call(env)
  end

  # Record the connecting peer's trust decision BEFORE any masking, so
  # secure? can authorize X-Forwarded-Proto canonically even after
  # REMOTE_ADDR is rewritten to the masked client IP. Leak-free boolean.
  #
  # This is the trusted-proxy *identity* check only — it is deliberately
  # independent of count-based depth mode. Depth resolves the client IP;
  # it never grants proxy trust for X-Forwarded-Proto (matching the
  # downstream OneTimeSecret behavior).
  env['otto.via_trusted_proxy'] = trusted_proxy?(env['REMOTE_ADDR'])

  # Same rationale, for loopback: this middleware runs outermost, so a
  # downstream middleware that must authenticate a DIRECT LOCAL CALL
  # (Otto::CaddyTLS::LocalhostGuard) can no longer read the true socket
  # peer from REMOTE_ADDR. Record the verdict here, on the untouched
  # peer, as a boolean — the address itself is never exposed.
  #
  # Deliberately the raw peer, NOT the resolved client IP: resolution
  # honors forwarded headers from trusted proxies, and a co-located
  # reverse proxy on loopback is itself a natural trusted proxy, so
  # resolving first would let `X-Forwarded-For: 127.0.0.1` promote a
  # remote caller to "localhost".
  env['otto.peer_loopback'] = Otto::Utils.loopback_address?(env['REMOTE_ADDR'])

  if privacy_enabled?
    apply_privacy(env)
  else
    apply_no_privacy(env)
  end

  @app.call(env)
end