CloudFlare Turnstile

[JPrevost]

Why are these changes being introduced:

• Bots are using more resources than desired

Relevant ticket(s):

• https://mitlibraries.atlassian.net/browse/TIMX-480

How does this address that need:

• Adds rack-attack and bot_challenge_page gems
• Adds redis to heroku app.json (will need to manually enable in staging and production environments before merge)

Developer

Accessibility

• ANDI or WAVE has been run in accordance to our guide.
• This PR contains no changes to the view layer.
• New issues flagged by ANDI or WAVE have been resolved.
• New issues flagged by ANDI or WAVE have been ticketed (link in the Pull Request details above).
• No new accessibility issues have been flagged.

New ENV

• All new ENV is documented in README.
• All new ENV has been added to Heroku Pipeline, Staging and Prod.
• ENV has not changed.

Approval beyond code review

• UXWS/stakeholder approval has been confirmed.
• UXWS/stakeholder review will be completed retroactively.
• UXWS/stakeholder review is not needed.

Additional context needed to review

E.g., if the PR includes updated dependencies and/or data
migration, or how to confirm the feature is working.

Code Reviewer

Code

• I have confirmed that the code works as intended.
• Any CodeClimate issues have been fixed or confirmed as
  added technical debt.

Documentation

• The commit message is clear and follows our guidelines
  (not just this pull request message).
• The documentation has been updated or is unnecessary.
• New dependencies are appropriate or there were no changes.

Testing

• There are appropriate tests covering any new functionality.
• No additional test coverage is required.

[coveralls]

Pull Request Test Coverage Report for Build 14038084987

Details

• 2 of 2 (100.0%) changed or added relevant lines in 1 file are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage increased (+0.005%) to 98.658%

---

Totals
Change from base Build 13844179321:	0.005%
Covered Lines:	588
Relevant Lines:	596

---

💛 - Coveralls

[jazairi]

Confirmed this works as described locally. (I.e., after 10 requests to /results, I get a 403 page.) I've never configured these tools before, so I can't offer much on that side of things, but the config seems straightforward enough.

As I understand it, the only risk introduced here is that a user will get a Cloudflare turnstile every 10 search attempts. That might be a little onerous for folks on an extended user journey, but since we can easily adjust it, I think it's fine as an initial setting.

[JPrevost]

@jazairi Just to clarify, once a user gets a turnstile challenge and passes they will not get another challenge in that browser instance for about a day regardless of how many searches they do.

[jazairi]

@JPrevost In that case, no concerns on my end.