search

mikker / passwordless

🗝 Authentication for your Rails app without the icky-ness of passwords
MIT License
1.26k stars 87 forks source link

remote_addr or remote_ip? #94

Closed xdmx closed 3 years ago

xdmx commented 3 years ago

I'm trying out the gem with an application that runs behind on cloudflare -> nginx -> puma and checking the remote_addr of all visits it's always 127.0.0.1, instead of the real ip (the app is live and requests were real / over the internet). From reading around it seems that when there is a proxy in between (like cloudflare, nginx, etc) remote_ip should be used instead.

Do you have any hints about this? Should it be changed in the gem itself or is it more "app based" (and thus override that setter)?

mikker commented 3 years ago

You may be able to get it via the x-forwarded-for header but I'm actually feeling more like we shouldn't store ips as a default anyway. If users, like you, want to store them, it's fairly easy to either monkey patch the included SessionsController or copy and modify it to their needs.

sairam commented 3 years ago

There is good discussion points around this here - https://stackoverflow.com/questions/10997005/whats-the-difference-between-request-remote-ip-and-request-ip-in-rails

If the app is behind nginx, it shows up as 127.0.0.1 .

Would be cleaner to provide a lambda so that developer can pass in a block like the rest of the initializers?

mikker commented 3 years ago

Have opened a feature request issue and will close this.