Security9 min read
Possible IP Spoofing in Action Dispatch RemoteIp (GHSA-2gff-2mmg-m73p)
A Rails 8.1 regression lets an attacker forge request.remote_ip with a crafted Forwarded header, bypassing IP allowlists, rate limits, and audit logs. What broke, why, how to reproduce it, and exactly how to fix it.