From 921b78190912b3cd74cea62fc3e773c56e8f609e Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Tue, 9 Jan 2018 17:07:54 +0100 Subject: [PATCH] Increase rate limit on protected paths (#6229) Previously each protected path had a separate rate limit. Now they're all in the same bucket, so people are more likely to hit one with register->login. Increasing to 25 per 5 minutes should be fine. --- config/initializers/rack_attack.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb index b38fb302b..b35452f04 100644 --- a/config/initializers/rack_attack.rb +++ b/config/initializers/rack_attack.rb @@ -53,7 +53,7 @@ class Rack::Attack req.ip if req.api_request? end - throttle('protected_paths', limit: 5, period: 5.minutes) do |req| + throttle('protected_paths', limit: 25, period: 5.minutes) do |req| req.ip if req.post? && req.path =~ PROTECTED_PATHS_REGEX end