You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

73 lines
1.9 KiB

  1. # frozen_string_literal: true
  2. require 'doorkeeper/grape/authorization_decorator'
  3. class Rack::Attack
  4. class Request
  5. def authenticated_token
  6. return @token if defined?(@token)
  7. @token = Doorkeeper::OAuth::Token.authenticate(
  8. Doorkeeper::Grape::AuthorizationDecorator.new(self),
  9. *Doorkeeper.configuration.access_token_methods
  10. )
  11. end
  12. def authenticated_user_id
  13. authenticated_token&.resource_owner_id
  14. end
  15. def unauthenticated?
  16. !authenticated_user_id
  17. end
  18. def api_request?
  19. path.start_with?('/api')
  20. end
  21. def web_request?
  22. !api_request?
  23. end
  24. end
  25. PROTECTED_PATHS = %w(
  26. /auth/sign_in
  27. /auth
  28. /auth/password
  29. ).freeze
  30. PROTECTED_PATHS_REGEX = Regexp.union(PROTECTED_PATHS.map { |path| /\A#{Regexp.escape(path)}/ })
  31. # Always allow requests from localhost
  32. # (blocklist & throttles are skipped)
  33. Rack::Attack.safelist('allow from localhost') do |req|
  34. # Requests are allowed if the return value is truthy
  35. '127.0.0.1' == req.ip || '::1' == req.ip
  36. end
  37. throttle('throttle_authenticated_api', limit: 300, period: 5.minutes) do |req|
  38. req.api_request? && req.authenticated_user_id
  39. end
  40. throttle('throttle_unauthenticated_api', limit: 7_500, period: 5.minutes) do |req|
  41. req.ip if req.api_request?
  42. end
  43. throttle('protected_paths', limit: 25, period: 5.minutes) do |req|
  44. req.ip if req.post? && req.path =~ PROTECTED_PATHS_REGEX
  45. end
  46. self.throttled_response = lambda do |env|
  47. now = Time.now.utc
  48. match_data = env['rack.attack.match_data']
  49. headers = {
  50. 'Content-Type' => 'application/json',
  51. 'X-RateLimit-Limit' => match_data[:limit].to_s,
  52. 'X-RateLimit-Remaining' => '0',
  53. 'X-RateLimit-Reset' => (now + (match_data[:period] - now.to_i % match_data[:period])).iso8601(6),
  54. }
  55. [429, headers, [{ error: I18n.t('errors.429') }.to_json]]
  56. end
  57. end