Does RackAttack have tests? We don't need to test tested software. I'm
happy with manual testing for this.


On Wed, Mar 5, 2014 at 1:35 PM, James Kiesel <notifications@github.com>wrote:

> In config/initializers/rack_attack.rb:
>
> > @@ -0,0 +1,2 @@
> > +Rack::Attack.cache.store = ActiveSupport::Cache::MemoryStore.new
> > +Rack::Attack.throttle 'req/ip', limit: 50, period: 1.second do |req| req.ip end
>
> I believe this is all we need to implement throttling for all pages; this
> is currently limiting to 50 requests per second, per ip. (The result of the
> 'do' block is which cache key the request gets logged under, so for IP
> 127.0.0.1, they'll call something like
>
>
> Rack::Attack.cache['127.0.0.1'].to_i += 1
> raise TooManyRequestsError if Rack::Attack.cache['127.0.0.1'] > 50
>
> Might do to have another chat about how we want to customize this further;
> the 50 requests / ip / second number seems well out of normal browsing
> range, but it is arbitrary.
>
> Seems to work for casual testing (if the rate limit is exceeded, the
> browser shoots back a HTTP 429: Too many requests error, but I want to
> have some automated testing surrounding that; could use a little help with
> that @s01us <https://github.com/s01us> @robguthrie<https://github.com/robguthrie>
> @jonlemmon <https://github.com/jonlemmon>?
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/loomio/loomio/pull/1346/files#r10282930>
> .
>