rack_attack.rb 2.0 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677
  1. # frozen_string_literal: true
  2. require 'doorkeeper/grape/authorization_decorator'
  3. class Rack::Attack
  4. class Request
  5. def authenticated_token
  6. return @token if defined?(@token)
  7. @token = Doorkeeper::OAuth::Token.authenticate(
  8. Doorkeeper::Grape::AuthorizationDecorator.new(self),
  9. *Doorkeeper.configuration.access_token_methods
  10. )
  11. end
  12. def authenticated_user_id
  13. authenticated_token&.resource_owner_id
  14. end
  15. def unauthenticated?
  16. !authenticated_user_id
  17. end
  18. def api_request?
  19. path.start_with?('/api')
  20. end
  21. def web_request?
  22. !api_request?
  23. end
  24. end
  25. PROTECTED_PATHS = %w(
  26. /auth/sign_in
  27. /auth
  28. /auth/password
  29. ).freeze
  30. PROTECTED_PATHS_REGEX = Regexp.union(PROTECTED_PATHS.map { |path| /\A#{Regexp.escape(path)}/ })
  31. # Always allow requests from localhost
  32. # (blocklist & throttles are skipped)
  33. Rack::Attack.safelist('allow from localhost') do |req|
  34. # Requests are allowed if the return value is truthy
  35. req.ip == '127.0.0.1' || req.ip == '::1'
  36. end
  37. throttle('throttle_authenticated_api', limit: 300, period: 5.minutes) do |req|
  38. req.api_request? && req.authenticated_user_id
  39. end
  40. throttle('throttle_unauthenticated_api', limit: 7_500, period: 5.minutes) do |req|
  41. req.ip if req.api_request?
  42. end
  43. throttle('throttle_media', limit: 30, period: 30.minutes) do |req|
  44. req.authenticated_user_id if req.post? && req.path.start_with?('/api/v1/media')
  45. end
  46. throttle('protected_paths', limit: 25, period: 5.minutes) do |req|
  47. req.ip if req.post? && req.path =~ PROTECTED_PATHS_REGEX
  48. end
  49. self.throttled_response = lambda do |env|
  50. now = Time.now.utc
  51. match_data = env['rack.attack.match_data']
  52. headers = {
  53. 'Content-Type' => 'application/json',
  54. 'X-RateLimit-Limit' => match_data[:limit].to_s,
  55. 'X-RateLimit-Remaining' => '0',
  56. 'X-RateLimit-Reset' => (now + (match_data[:period] - now.to_i % match_data[:period])).iso8601(6),
  57. }
  58. [429, headers, [{ error: I18n.t('errors.429') }.to_json]]
  59. end
  60. end