kickstarter/rack-attack — pull request #90 by wkimeria (2014-09-22 22:54:28+00:00)
Title: Adding Conditional Throttle

Added a ConditionalThrottle filter, which checks to see whether a limit has
been reached but does not increment for each request.

To increment, call the Rack::Attack.increment_counter

Usage (Conditionally throttling on failed logins)

Rack::Attack.conditional_throttle('login',
:limit => ...,
:period => 1.hour) { |request|
if is_rate_limited_uri?(request) && request.post?
request.params['...
end
}

To increment counter
if(failed_login)
Rack::Attack.increment_counter('login', request.params['...
end

This support the use case where one wants to rate limit failed
logins only.
For example, we set a limit of 5 failed logins per hour.
Successful requests do not increment counter, failed requests do
(by an explicit call to increment_counter on failure).
Once that limit is reached, all requests, including correct
logins are blocked until the timout
expires.
In addition, successful logins do not increment/refresh the counter.