Move TrackTrueClientIp middleware into saas engine#2677
Conversation
The True-Client-IP header is set by Cloudflare and is only trustworthy when behind a Cloudflare proxy. In non-Cloudflare deployments, this header is attacker-controlled and can be used to spoof IP addresses. Moving the middleware into the saas engine ensures it only loads for our Cloudflare-fronted production deployment, not for self-hosted OSS instances. GHSA-cpch-9qg2-x8fq
There was a problem hiding this comment.
Pull request overview
Moves the TrackTrueClientIp middleware installation into the fizzy-saas Rails engine so the True-Client-IP → X-Forwarded-For behavior is only enabled when the SaaS engine is loaded.
Changes:
- Adds a SaaS-engine test covering
TrackTrueClientIpheader mutation behavior. - Removes the middleware stack mutation from
true_client_ip.rband installs it via a Rails engine initializer instead. - Ensures the middleware code is required by the engine during boot.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
saas/test/lib/true_client_ip_test.rb |
Adds unit tests for TrackTrueClientIp behavior. |
saas/lib/fizzy/saas/true_client_ip.rb |
Removes direct Rails.application.config.middleware mutation from the library file. |
saas/lib/fizzy/saas/engine.rb |
Requires the middleware and installs it via an engine initializer. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
| initializer "fizzy_saas.true_client_ip" do |app| | ||
| app.config.middleware.insert_before ActionDispatch::RemoteIp, TrackTrueClientIp | ||
| end |
There was a problem hiding this comment.
The new engine initializer inserts TrackTrueClientIp into the middleware stack, but the added test only exercises the middleware’s behavior in isolation. Since the main change in this PR is where/when the middleware is installed, consider adding a saas-mode test that asserts Rails.application.middleware includes TrackTrueClientIp before ActionDispatch::RemoteIp (and ideally doesn’t get inserted twice).
Summary
True-Client-IPheader is set by Cloudflare and can be spoofed in non-Cloudflare deploymentsTrackTrueClientIpmiddleware and its test into the saas engine so it only loads for Cloudflare-fronted deploymentsGHSA-cpch-9qg2-x8fq
Test plan
SAAS=true BUNDLE_GEMFILE=Gemfile.saas bin/rails middleware)bin/rails middleware | grep TrueClient)