Disable IP spoofing check in production

[posthog]

Problem

• Any client can force a 500 on the API by sending a Client-IP header — it is client-supplied, so the error is repeatable at will. Error tracking first saw it on 2026-08-10.
• ActionDispatch::RemoteIp raises IpSpoofAttackError when Client-IP disagrees with X-Forwarded-For. Our chain is <cloudflare-edge>, <internal-docker-hop>, so a spoofed Client-IP fails the check.
• The failure happens in Rails::Rack::Logger#started_request_message, before the request reaches a controller. No data loss, no broken flow — the guard is a Rails safety check, not a vulnerability.
• Root cause is a config gap: config/environments/production.rb sets assume_ssl and force_ssl but never sets config.action_dispatch.ip_spoofing_check, so the check runs with its default of true.

Changes

+  config.action_dispatch.ip_spoofing_check = false

• The app runs behind Cloudflare plus an internal Docker proxy, so the trusted client IP comes from the proxy, not from a client-supplied header. Turning the check off is the standard setting for this topology.

Alternatives considered

Option	Note
ip_spoofing_check = false (chosen)	Standard for an app behind Cloudflare; the header chain, not the client, is the source of truth.
Keep the check, add Docker ranges to trusted_proxies	More config to maintain; still needs the internal ranges listed.

Risk

• No code reads request.remote_ip for a security decision (verified with a repo-wide search), so relaxing the check does not weaken any access control.

---

Created with PostHog Desktop from this inbox report.