Rails ActionController: Difference between request.remote_ip and request.remote_addr

Question

In the ActionController source, local requests are defined as follows:

def local_request? #:doc:
    request.remote_addr == LOCALHOST && request.remote_ip == LOCALHOST
end

In my application, I want to use different logic if requests are coming from a particular IP range. What is the difference between request.remote_addr and request.remote_ip, and which one should I use?

Answer 1

I'm the author of the current implementation of remote_ip, and the other things that it does include checking for IP spoofing attacks, and correctly handling multiple X-Forwarded-For headers. There's a big caveat, though: only some Ruby web servers support multiple headers, so the value still might be wrong.

I wrote up the results from testing the most popular Ruby app servers on my blog, which you might want to check out if repeated headers matter for your application.