# Client-IP Rails issue

**URL:** <https://www.ruby-forum.com/t/client-ip-rails-issue/151179>\
**Category:** NGINX\
**Created:** [October 17, 2008, 7:01pm UTC](https://www.ruby-forum.com/t/client-ip-rails-issue/151179 "2008-10-17T19:01:11Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![soderic](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/8baadc/32.png) [@soderic](https://www.ruby-forum.com/u/soderic)\
**Post date:** [October 17, 2008, 7:01pm UTC](https://www.ruby-forum.com/t/client-ip-rails-issue/151179/1 "2008-10-17T19:01:11Z")

</div>

I host a rails app using nginx. Until I recently upgrade rails to  
2.1.1, everything worked great. This update to rails included a feature  
designed to stop IP spoofing attacks. The way it does it is if the  
client-ip header and the forwarded-for header are both present it throws  
a 500 error. Yahoo’s slurp bot uses that as well as DirecPC satellite  
internet. I found a solution for Apache web servers but I can’t figure  
out how to accomplish the same thing with nginx. I pasted the Apache  
solution below. Any help is appreciated.

“I deploy Rails in a common Apache w/mod\_proxy\_balancer and Mongrel  
setup. Apache uses X-Forwarded-For natively, so that’s the one I want to  
trust. To make Rails happy, I’ve just told Apache to delete the  
Client-IP header if present.  
Adding RequestHeader unset Client-IP to the virtual host configuration  
seems to do the trick.”

Thanks again,  
Eric.

---

<div class="post-metadata">

**Author:** ![soderic](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/8baadc/32.png) [@soderic](https://www.ruby-forum.com/u/soderic)\
**Post date:** [July 13, 2009, 6:03pm UTC](https://www.ruby-forum.com/t/client-ip-rails-issue/151179/2 "2009-07-13T18:03:33Z")

</div>

Hope this helps someone -

[https://rails.lighthouseapp.com/projects/8994/tickets/322](https://rails.lighthouseapp.com/projects/8994/tickets/322)

Shai.