RackAttack: use remote ip and test it !
This commit is contained in:
parent
b7f8bb2fea
commit
0f0fecdb25
3 changed files with 67 additions and 5 deletions
|
@ -1,21 +1,25 @@
|
|||
if ENV['RAILS_ENV'] != 'test'
|
||||
if Rails.env.production?
|
||||
class Rack::Attack
|
||||
throttle('logins/ip', limit: 5, period: 20.seconds) do |req|
|
||||
throttle('/users/sign_in/ip', limit: 5, period: 20.seconds) do |req|
|
||||
if req.path == '/users/sign_in' && req.post?
|
||||
req.ip
|
||||
req.remote_ip
|
||||
end
|
||||
end
|
||||
|
||||
throttle('stats/ip', limit: 5, period: 20.seconds) do |req|
|
||||
if req.path == '/stats'
|
||||
req.ip
|
||||
req.remote_ip
|
||||
end
|
||||
end
|
||||
|
||||
throttle('contact/ip', limit: 5, period: 20.seconds) do |req|
|
||||
if req.path == '/contact' && req.post?
|
||||
req.ip
|
||||
req.remote_ip
|
||||
end
|
||||
end
|
||||
|
||||
Rack::Attack.safelist('allow from localhost') do |req|
|
||||
IPService.ip_trusted?(req.remote_ip)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
7
config/initializers/rack_attack_request.rb
Normal file
7
config/initializers/rack_attack_request.rb
Normal file
|
@ -0,0 +1,7 @@
|
|||
class Rack::Attack
|
||||
class Request < ::Rack::Request
|
||||
def remote_ip
|
||||
@remote_ip ||= (env['action_dispatch.remote_ip'] || ip).to_s
|
||||
end
|
||||
end
|
||||
end
|
Loading…
Add table
Add a link
Reference in a new issue