From a865b62efc0f7025f789f4413a03ccacd57db7bb Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Sat, 9 Dec 2017 14:20:02 +0100 Subject: Rate limit by user instead of IP when API user is authenticated (#5923) * Fix #668 - Rate limit by user instead of IP when API user is authenticated * Fix code style issue * Use request decorator provided by Doorkeeper --- config/initializers/rack_attack.rb | 55 ++++++++++++++++++++++++++++---------- 1 file changed, 41 insertions(+), 14 deletions(-) (limited to 'config/initializers/rack_attack.rb') diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb index 53cb106ca..fddcbc52c 100644 --- a/config/initializers/rack_attack.rb +++ b/config/initializers/rack_attack.rb @@ -1,6 +1,41 @@ # frozen_string_literal: true class Rack::Attack + class Request + def authenticated_token + return @token if defined?(@token) + + @token = Doorkeeper::OAuth::Token.authenticate( + Doorkeeper::Grape::AuthorizationDecorator.new(self), + *Doorkeeper.configuration.access_token_methods + ) + end + + def authenticated_user_id + authenticated_token&.resource_owner_id + end + + def unauthenticated? + !authenticated_user_id + end + + def api_request? + path.start_with?('/api') + end + + def web_request? + !api_request? + end + end + + PROTECTED_PATHS = %w( + /auth/sign_in + /auth + /auth/password + ).freeze + + PROTECTED_PATHS_REGEX = Regexp.union(PROTECTED_PATHS.map { |path| /\A#{Regexp.escape(path)}/ }) + # Always allow requests from localhost # (blocklist & throttles are skipped) Rack::Attack.safelist('allow from localhost') do |req| @@ -8,24 +43,16 @@ class Rack::Attack '127.0.0.1' == req.ip || '::1' == req.ip end - # Rate limits for the API - throttle('api', limit: 300, period: 5.minutes) do |req| - req.ip if req.path =~ /\A\/api\/v/ - end - - # Rate limit logins - throttle('login', limit: 5, period: 5.minutes) do |req| - req.ip if req.path == '/auth/sign_in' && req.post? + throttle('throttle_authenticated_api', limit: 300, period: 5.minutes) do |req| + req.api_request? && req.authenticated_user_id end - # Rate limit sign-ups - throttle('register', limit: 5, period: 5.minutes) do |req| - req.ip if req.path == '/auth' && req.post? + throttle('throttle_unauthenticated_api', limit: 300, period: 5.minutes) do |req| + req.ip if req.api_request? && req.unauthenticated? end - # Rate limit forgotten passwords - throttle('reminder', limit: 5, period: 5.minutes) do |req| - req.ip if req.path == '/auth/password' && req.post? + throttle('protected_paths', limit: 5, period: 5.minutes) do |req| + req.ip if req.post? && req.path =~ PROTECTED_PATHS_REGEX end self.throttled_response = lambda do |env| -- cgit From 4bce376fdc7f5c5c6e2a2e33974e3712425d5874 Mon Sep 17 00:00:00 2001 From: Naoki Kosaka Date: Sat, 9 Dec 2017 23:12:10 +0900 Subject: Missing require 'authorization_decorator'. (#5947) --- config/initializers/rack_attack.rb | 2 ++ 1 file changed, 2 insertions(+) (limited to 'config/initializers/rack_attack.rb') diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb index fddcbc52c..41db76929 100644 --- a/config/initializers/rack_attack.rb +++ b/config/initializers/rack_attack.rb @@ -1,5 +1,7 @@ # frozen_string_literal: true +require 'doorkeeper/grape/authorization_decorator' + class Rack::Attack class Request def authenticated_token -- cgit From feed07227ba9feb8def161dc127033016c749ac5 Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Mon, 11 Dec 2017 15:32:29 +0100 Subject: Apply a 25x rate limit by IP even to authenticated requests (#5948) --- app/controllers/concerns/rate_limit_headers.rb | 4 ++-- config/initializers/rack_attack.rb | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) (limited to 'config/initializers/rack_attack.rb') diff --git a/app/controllers/concerns/rate_limit_headers.rb b/app/controllers/concerns/rate_limit_headers.rb index ac9b58f5d..b79c558d8 100644 --- a/app/controllers/concerns/rate_limit_headers.rb +++ b/app/controllers/concerns/rate_limit_headers.rb @@ -44,8 +44,8 @@ module RateLimitHeaders end def api_throttle_data - request.env['rack.attack.throttle_data']['throttle_authenticated_api'] || - request.env['rack.attack.throttle_data']['throttle_unauthenticated_api'] + most_limited_type, = request.env['rack.attack.throttle_data'].min_by { |_, v| v[:limit] } + request.env['rack.attack.throttle_data'][most_limited_type] end def request_time diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb index 41db76929..b38fb302b 100644 --- a/config/initializers/rack_attack.rb +++ b/config/initializers/rack_attack.rb @@ -49,8 +49,8 @@ class Rack::Attack req.api_request? && req.authenticated_user_id end - throttle('throttle_unauthenticated_api', limit: 300, period: 5.minutes) do |req| - req.ip if req.api_request? && req.unauthenticated? + throttle('throttle_unauthenticated_api', limit: 7_500, period: 5.minutes) do |req| + req.ip if req.api_request? end throttle('protected_paths', limit: 5, period: 5.minutes) do |req| -- cgit