diff options
| -rw-r--r-- | config/initializers/rack_attack.rb (renamed from config/initializers/rack-attack.rb) | 19 |
1 files changed, 18 insertions, 1 deletions
diff --git a/config/initializers/rack-attack.rb b/config/initializers/rack_attack.rb index 70f7846d1..67ec7c919 100644 --- a/config/initializers/rack-attack.rb +++ b/config/initializers/rack_attack.rb @@ -1,7 +1,24 @@ +# frozen_string_literal: true + class Rack::Attack # Rate limits for the API throttle('api', limit: 300, period: 5.minutes) do |req| - req.ip if req.path.match(/\A\/api\/v/) + req.ip if req.path =~ /\A\/api\/v/ + end + + # Rate limit logins + throttle('login', limit: 5, period: 5.minutes) do |req| + req.ip if req.path == '/auth/sign_in' && req.post? + end + + # Rate limit sign-ups + throttle('register', limit: 5, period: 5.minutes) do |req| + req.ip if req.path == '/auth' && req.post? + end + + # Rate limit forgotten passwords + throttle('reminder', limit: 5, period: 5.minutes) do |req| + req.ip if req.path == '/auth/password' && req.post? end self.throttled_response = lambda do |env| |