title: How to understand and reduce IP spoofing attack errors in a Rails application?
body: <p>I'm getting lots of emails from my error reporting service about IP spoofing attacks with increasing frequency. If I understand correctly, this occurs when the request sets an HTTP header specifying that the IP address the request is coming from was not the original IP address.</p>
  
  <p>The error message looks like this:</p>
  
  <pre><code>IP spoofing attack?!HTTP_CLIENT_IP="10.212.0.172"HTTP_X_FORWARDED_FOR="10.212.0.172, 68.180.224.232"
  </code></pre>
  
  <p>If I'm reading this correctly, the two IP addresses in this error message are a local IP address (10.x.x.x) and a Yahoo! IP address (68.180.224.232).</p>
  
  <p>I'm not sure if I'm reading that correctly, but it seems that this may be caused from a Yahoo crawler. The error reports on lots of different URLs which makes it seem like a crawler. Also, it seems like a legitimate request because it's an internal IP that is being routed through an external IP.</p>
  
  <p>My questions are:</p>
  
  <ul>
  <li>How do you determine if these are legitimate requests or malicious.</li>
  <li>If malicious, what's the harm in allowing these GET requests?</li>
  <li>Either way, how can I prevent these errors from occurring (besides turning off the email notification)? Do I need to find a way to block the IP address? What if it's a legitimate request? Do I need to set up a whitelist of some sort?</li>
  </ul>
  
  <p><strong>Update</strong>: I reviewed the request parameters and the user agent is indeed a Yahoo crawler:</p>
  
  <p>Mozilla/5.0 (compatible; Yahoo! Slurp; <a href="http://help.yahoo.com/help/us/ysearch/slurp" rel="noreferrer">http://help.yahoo.com/help/us/ysearch/slurp</a>)</p>