|
1 | 1 | # frozen_string_literal: true |
2 | 2 |
|
| 3 | +require 'json' |
3 | 4 | require 'rack/attack' |
4 | 5 | require_relative '../app/security_logger' |
5 | 6 |
|
6 | 7 | # In-memory store (resets on restart) |
7 | 8 | # Note: In production, consider using Redis for persistent rate limiting |
8 | 9 | Rack::Attack.cache.store = {} |
9 | 10 |
|
10 | | -# Whitelist health checks and internal IPs |
11 | | -Rack::Attack.safelist('health-check') do |req| |
12 | | - req.path.start_with?('/health', '/status') |
13 | | -end |
| 11 | +STANDARD_WINDOW = 60 |
| 12 | +STANDARD_LIMIT = 100 |
| 13 | +TOKEN_LIMIT = 60 |
14 | 14 |
|
15 | | -# Whitelist localhost in development |
16 | | -Rack::Attack.safelist('localhost') do |req| |
17 | | - %w[127.0.0.1 ::1].include?(req.ip) if ENV['RACK_ENV'] == 'development' |
18 | | -end |
| 15 | +Rack::Attack.throttle('requests per ip', limit: STANDARD_LIMIT, period: STANDARD_WINDOW, &:ip) |
19 | 16 |
|
20 | | -# Rate limiting by IP |
21 | | -Rack::Attack.throttle('requests per IP', limit: 100, period: 60) do |req| |
22 | | - Html2rss::Web::SecurityLogger.log_rate_limit_exceeded(req.ip, req.path, 100) if req.env['rack.attack.throttle_data'] |
23 | | - req.ip |
24 | | -end |
| 17 | +token_from_header = lambda do |req| |
| 18 | + header = req.get_header('HTTP_AUTHORIZATION') |
| 19 | + next unless header&.start_with?('Bearer ') |
25 | 20 |
|
26 | | -# Rate limiting for API endpoints |
27 | | -Rack::Attack.throttle('api requests per IP', limit: 200, period: 60) do |req| |
28 | | - if req.path.start_with?('/api/') |
29 | | - Html2rss::Web::SecurityLogger.log_rate_limit_exceeded(req.ip, req.path, 200) if req.env['rack.attack.throttle_data'] |
30 | | - req.ip |
31 | | - end |
| 21 | + token = header.split(' ', 2)[1]&.strip |
| 22 | + token unless token.nil? || token.empty? |
32 | 23 | end |
33 | 24 |
|
34 | | -# Rate limiting for API feed generation (more restrictive) |
35 | | -Rack::Attack.throttle('api feed generation per IP', limit: 10, period: 60) do |req| |
36 | | - if req.path.include?('/api/v1/feeds/') && req.params['token'] |
37 | | - Html2rss::Web::SecurityLogger.log_rate_limit_exceeded(req.ip, req.path, 10) if req.env['rack.attack.throttle_data'] |
38 | | - req.ip |
39 | | - end |
| 25 | +token_from_path = lambda do |req| |
| 26 | + match = req.path.match(%r{^/api/v1/feeds/([^/]+)}) |
| 27 | + match && match[1] |
40 | 28 | end |
41 | 29 |
|
42 | | -# Block suspicious patterns |
43 | | -Rack::Attack.blocklist('block bad user agents') do |req| |
44 | | - if req.user_agent&.match?(/bot|crawler|spider/i) && !req.user_agent&.match?(/googlebot|bingbot/i) |
45 | | - Html2rss::Web::SecurityLogger.log_blocked_request(req.ip, 'suspicious_user_agent', req.path) |
46 | | - true |
47 | | - end |
| 30 | +Rack::Attack.throttle('requests per token', limit: TOKEN_LIMIT, period: STANDARD_WINDOW) do |req| |
| 31 | + token_from_header.call(req) || token_from_path.call(req) |
48 | 32 | end |
49 | 33 |
|
50 | | -# Custom responses with proper headers |
51 | | -Rack::Attack.throttled_response = lambda do |_env| |
52 | | - retry_after = 60 |
53 | | - [ |
54 | | - 429, |
55 | | - { |
56 | | - 'Content-Type' => 'application/xml', |
57 | | - 'Retry-After' => retry_after.to_s, |
58 | | - 'X-RateLimit-Limit' => '100', |
59 | | - 'X-RateLimit-Remaining' => '0', |
60 | | - 'X-RateLimit-Reset' => (Time.now + retry_after).to_i.to_s |
61 | | - }, |
62 | | - ['<rss><channel><title>Rate Limited</title><description>Too many requests. ' \ |
63 | | - 'Please try again later.</description></channel></rss>'] |
64 | | - ] |
| 34 | +Rack::Attack.throttled_response = lambda do |env| |
| 35 | + Html2rss::Web::RackAttackResponse.call(env) |
65 | 36 | end |
66 | 37 |
|
67 | | -# Track blocked requests for monitoring |
68 | | -Rack::Attack.blocklisted_response = lambda do |_env| |
69 | | - [ |
70 | | - 403, |
71 | | - { 'Content-Type' => 'application/xml' }, |
72 | | - ['<rss><channel><title>Access Denied</title><description>Request blocked by ' \ |
73 | | - 'security policy.</description></channel></rss>'] |
74 | | - ] |
| 38 | +module Html2rss |
| 39 | + module Web |
| 40 | + module RackAttackResponse |
| 41 | + module_function |
| 42 | + |
| 43 | + def call(env) |
| 44 | + request = Rack::Request.new(env) |
| 45 | + match_data = env['rack.attack.match_data'] || {} |
| 46 | + limit = match_data[:limit] || STANDARD_LIMIT |
| 47 | + |
| 48 | + Html2rss::Web::SecurityLogger.log_rate_limit_exceeded(request.ip, request.path, limit) |
| 49 | + |
| 50 | + retry_after = STANDARD_WINDOW |
| 51 | + return api_response(retry_after) if request.path.start_with?('/api/') |
| 52 | + |
| 53 | + text_response(retry_after) |
| 54 | + end |
| 55 | + |
| 56 | + def api_response(retry_after) |
| 57 | + body = { |
| 58 | + success: false, |
| 59 | + error: { code: 'TOO_MANY_REQUESTS', message: 'Too many requests. Please try again later.' } |
| 60 | + }.to_json |
| 61 | + |
| 62 | + [ |
| 63 | + 429, |
| 64 | + { |
| 65 | + 'Content-Type' => 'application/json', |
| 66 | + 'Retry-After' => retry_after.to_s |
| 67 | + }, |
| 68 | + [body] |
| 69 | + ] |
| 70 | + end |
| 71 | + |
| 72 | + def text_response(retry_after) |
| 73 | + [ |
| 74 | + 429, |
| 75 | + { |
| 76 | + 'Content-Type' => 'text/plain', |
| 77 | + 'Retry-After' => retry_after.to_s |
| 78 | + }, |
| 79 | + ['Too many requests. Please try again later.'] |
| 80 | + ] |
| 81 | + end |
| 82 | + end |
| 83 | + end |
75 | 84 | end |
0 commit comments