p.s. Looks great


On Wed, Mar 5, 2014 at 2:31 PM, Robert Guthrie <rguthrie@gmail.com> wrote:

> Does RackAttack have tests? We don't need to test tested software. I'm
> happy with manual testing for this.
>
>
> On Wed, Mar 5, 2014 at 1:35 PM, James Kiesel <notifications@github.com>wrote:
>
>> In config/initializers/rack_attack.rb:
>>
>> > @@ -0,0 +1,2 @@
>> > +Rack::Attack.cache.store = ActiveSupport::Cache::MemoryStore.new
>> > +Rack::Attack.throttle 'req/ip', limit: 50, period: 1.second do |req| req.ip end
>>
>> I believe this is all we need to implement throttling for all pages; this
>> is currently limiting to 50 requests per second, per ip. (The result of the
>> 'do' block is which cache key the request gets logged under, so for IP
>> 127.0.0.1, they'll call something like
>>
>>
>> Rack::Attack.cache['127.0.0.1'].to_i += 1
>> raise TooManyRequestsError if Rack::Attack.cache['127.0.0.1'] > 50
>>
>> Might do to have another chat about how we want to customize this
>> further; the 50 requests / ip / second number seems well out of normal
>> browsing range, but it is arbitrary.
>>
>> Seems to work for casual testing (if the rate limit is exceeded, the
>> browser shoots back a HTTP 429: Too many requests error, but I want to
>> have some automated testing surrounding that; could use a little help with
>> that @s01us <https://github.com/s01us> @robguthrie<https://github.com/robguthrie>
>> @jonlemmon <https://github.com/jonlemmon>?
>>
>> —
>> Reply to this email directly or view it on GitHub<https://github.com/loomio/loomio/pull/1346/files#r10282930>
>> .
>>
>
>