Reduce unnecessary calls to Rack::Request.ip_filter #2287
Conversation
Previously this was typically invoked for every address found in REMOTE_ADDR/HTTP_FORWARDED/HTTP_X_FORWARDED_FOR. When ip_filter matches against several hundred IP ranges (eg. Cloudfront IP ranges), whole ms could be wasted. Now it'll only be invoked until one acceptable address is found.
jeremyevans
left a comment
There was a problem hiding this comment.
Thanks for working on this!
|
@willbryant do you mind adding an entry to the changelog? |
ioquatix
left a comment
There was a problem hiding this comment.
I'm okay with this. Of note, is that rejected_trusted_ip_addresses was removed, a public interface. Of course, it's no longer useful and was probably an implementation detail, and I checked GitHub code search and could not see any usage in the wild.
|
Yeah, I did wonder about that - and came to the same conclusion, but do you think I should restore it until a future major release to be on the safe side? |
|
One option is to restore it and add a deprecation note to it. It is the safest approach. However, it also makes more work for maintainers. So, I'm okay with either option. Let's see what @jeremyevans thinks. |
Are you sure it was public? It comes after the |
|
Ah yeah you are right, it's way up there haha. |
Previously this was typically invoked for every address found in REMOTE_ADDR/HTTP_FORWARDED/HTTP_X_FORWARDED_FOR. When ip_filter matches against several hundred IP ranges (eg. Cloudfront IP ranges), whole ms could be wasted.
Now it'll only be invoked until one acceptable address is found.