gitlab-org--gitlab-foss/spec/requests/rack_attack_global_spec.rb

359 lines
13 KiB
Ruby
Raw Normal View History

2017-10-11 19:39:58 -04:00
require 'spec_helper'
2017-10-13 20:13:11 -04:00
describe 'Rack Attack global throttles' do
include RackAttackSpecHelpers
2017-10-11 19:39:58 -04:00
let(:settings) { Gitlab::CurrentSettings.current_application_settings }
# Start with really high limits and override them with low limits to ensure
# the right settings are being exercised
let(:settings_to_set) do
{
throttle_unauthenticated_requests_per_period: 100,
throttle_unauthenticated_period_in_seconds: 1,
throttle_authenticated_api_requests_per_period: 100,
throttle_authenticated_api_period_in_seconds: 1,
throttle_authenticated_web_requests_per_period: 100,
throttle_authenticated_web_period_in_seconds: 1,
throttle_authenticated_protected_paths_request_per_period: 100,
throttle_authenticated_protected_paths_in_seconds: 1
}
end
let(:requests_per_period) { 1 }
let(:period_in_seconds) { 10000 }
let(:period) { period_in_seconds.seconds }
include_context 'rack attack cache store'
2017-10-11 19:39:58 -04:00
2017-10-13 20:05:18 -04:00
describe 'unauthenticated requests' do
let(:url_that_does_not_require_authentication) { '/users/sign_in' }
let(:url_api_internal) { '/api/v4/internal/check' }
2017-10-11 19:39:58 -04:00
before do
# Disabling protected paths throttle, otherwise requests to
# '/users/sign_in' are caught by this throttle.
settings_to_set[:throttle_protected_paths_enabled] = false
2017-10-11 19:39:58 -04:00
# Set low limits
settings_to_set[:throttle_unauthenticated_requests_per_period] = requests_per_period
settings_to_set[:throttle_unauthenticated_period_in_seconds] = period_in_seconds
2017-10-11 19:39:58 -04:00
end
context 'when the throttle is enabled' do
before do
settings_to_set[:throttle_unauthenticated_enabled] = true
stub_application_setting(settings_to_set)
2017-10-11 19:39:58 -04:00
end
it 'rejects requests over the rate limit' do
# At first, allow requests under the rate limit.
requests_per_period.times do
2017-10-31 14:36:33 -04:00
get url_that_does_not_require_authentication
2017-10-11 19:39:58 -04:00
expect(response).to have_http_status 200
end
# the last straw
2017-10-31 14:36:33 -04:00
expect_rejection { get url_that_does_not_require_authentication }
2017-10-11 19:39:58 -04:00
end
it 'allows requests after throttling and then waiting for the next period' do
requests_per_period.times do
2017-10-31 14:36:33 -04:00
get url_that_does_not_require_authentication
2017-10-11 19:39:58 -04:00
expect(response).to have_http_status 200
end
2017-10-31 14:36:33 -04:00
expect_rejection { get url_that_does_not_require_authentication }
2017-10-11 19:39:58 -04:00
2017-11-07 05:58:10 -05:00
Timecop.travel(period.from_now) do
2017-10-11 19:39:58 -04:00
requests_per_period.times do
2017-10-31 14:36:33 -04:00
get url_that_does_not_require_authentication
2017-10-11 19:39:58 -04:00
expect(response).to have_http_status 200
end
2017-10-31 14:36:33 -04:00
expect_rejection { get url_that_does_not_require_authentication }
2017-10-11 19:39:58 -04:00
end
end
2017-10-13 20:05:18 -04:00
it 'counts requests from different IPs separately' do
2017-10-11 19:39:58 -04:00
requests_per_period.times do
2017-10-31 14:36:33 -04:00
get url_that_does_not_require_authentication
2017-10-11 19:39:58 -04:00
expect(response).to have_http_status 200
end
expect_any_instance_of(Rack::Attack::Request).to receive(:ip).and_return('1.2.3.4')
2017-10-13 20:05:18 -04:00
# would be over limit for the same IP
2017-10-31 14:36:33 -04:00
get url_that_does_not_require_authentication
2017-10-13 20:05:18 -04:00
expect(response).to have_http_status 200
2017-10-11 19:39:58 -04:00
end
context 'when the request is to the api internal endpoints' do
it 'allows requests over the rate limit' do
(1 + requests_per_period).times do
get url_api_internal, params: { secret_token: Gitlab::Shell.secret_token }
expect(response).to have_http_status 200
end
end
end
it 'logs RackAttack info into structured logs' do
requests_per_period.times do
get url_that_does_not_require_authentication
expect(response).to have_http_status 200
end
arguments = {
message: 'Rack_Attack',
env: :throttle,
remote_ip: '127.0.0.1',
request_method: 'GET',
path: '/users/sign_in'
}
expect(Gitlab::AuthLogger).to receive(:error).with(arguments)
get url_that_does_not_require_authentication
end
2017-10-11 19:39:58 -04:00
end
context 'when the throttle is disabled' do
before do
settings_to_set[:throttle_unauthenticated_enabled] = false
stub_application_setting(settings_to_set)
2017-10-11 19:39:58 -04:00
end
it 'allows requests over the rate limit' do
(1 + requests_per_period).times do
2017-10-31 14:36:33 -04:00
get url_that_does_not_require_authentication
2017-10-11 19:39:58 -04:00
expect(response).to have_http_status 200
end
end
end
end
2017-10-13 20:05:18 -04:00
describe 'API requests authenticated with personal access token', :api do
let(:user) { create(:user) }
let(:token) { create(:personal_access_token, user: user) }
let(:other_user) { create(:user) }
let(:other_user_token) { create(:personal_access_token, user: other_user) }
let(:throttle_setting_prefix) { 'throttle_authenticated_api' }
let(:api_partial_url) { '/todos' }
2017-10-13 20:05:18 -04:00
context 'with the token in the query string' do
2017-10-31 14:36:33 -04:00
let(:get_args) { [api(api_partial_url, personal_access_token: token)] }
let(:other_user_get_args) { [api(api_partial_url, personal_access_token: other_user_token)] }
2017-10-13 20:05:18 -04:00
it_behaves_like 'rate-limited token-authenticated requests'
end
context 'with the token in the headers' do
2017-10-31 14:36:33 -04:00
let(:get_args) { api_get_args_with_token_headers(api_partial_url, personal_access_token_headers(token)) }
let(:other_user_get_args) { api_get_args_with_token_headers(api_partial_url, personal_access_token_headers(other_user_token)) }
2017-10-13 20:05:18 -04:00
it_behaves_like 'rate-limited token-authenticated requests'
end
end
describe 'API requests authenticated with OAuth token', :api do
let(:user) { create(:user) }
let(:application) { Doorkeeper::Application.create!(name: "MyApp", redirect_uri: "https://app.com", owner: user) }
let(:token) { Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: "api") }
2017-10-13 20:05:18 -04:00
let(:other_user) { create(:user) }
let(:other_user_application) { Doorkeeper::Application.create!(name: "MyApp", redirect_uri: "https://app.com", owner: other_user) }
let(:other_user_token) { Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: other_user.id, scopes: "api") }
2017-10-13 20:05:18 -04:00
let(:throttle_setting_prefix) { 'throttle_authenticated_api' }
let(:api_partial_url) { '/todos' }
2017-10-13 20:05:18 -04:00
context 'with the token in the query string' do
2017-10-31 14:36:33 -04:00
let(:get_args) { [api(api_partial_url, oauth_access_token: token)] }
let(:other_user_get_args) { [api(api_partial_url, oauth_access_token: other_user_token)] }
2017-10-13 20:05:18 -04:00
it_behaves_like 'rate-limited token-authenticated requests'
end
context 'with the token in the headers' do
2017-10-31 14:36:33 -04:00
let(:get_args) { api_get_args_with_token_headers(api_partial_url, oauth_token_headers(token)) }
let(:other_user_get_args) { api_get_args_with_token_headers(api_partial_url, oauth_token_headers(other_user_token)) }
2017-10-13 20:05:18 -04:00
it_behaves_like 'rate-limited token-authenticated requests'
end
end
describe '"web" (non-API) requests authenticated with RSS token' do
let(:user) { create(:user) }
let(:other_user) { create(:user) }
let(:throttle_setting_prefix) { 'throttle_authenticated_web' }
context 'with the token in the query string' do
let(:get_args) { [rss_url(user), params: nil] }
let(:other_user_get_args) { [rss_url(other_user), params: nil] }
2017-10-13 20:05:18 -04:00
2017-11-10 13:17:55 -05:00
it_behaves_like 'rate-limited token-authenticated requests'
2017-10-13 20:05:18 -04:00
end
end
describe 'web requests authenticated with regular login' do
let(:throttle_setting_prefix) { 'throttle_authenticated_web' }
2017-10-11 19:39:58 -04:00
let(:user) { create(:user) }
let(:url_that_requires_authentication) { '/dashboard/snippets' }
2017-10-11 19:39:58 -04:00
it_behaves_like 'rate-limited web authenticated requests'
2017-10-11 19:39:58 -04:00
end
2017-10-13 20:05:18 -04:00
describe 'protected paths' do
context 'unauthenticated requests' do
let(:protected_path_that_does_not_require_authentication) do
'/users/confirmation'
end
before do
settings_to_set[:throttle_protected_paths_requests_per_period] = requests_per_period # 1
settings_to_set[:throttle_protected_paths_period_in_seconds] = period_in_seconds # 10_000
end
context 'when protected paths throttle is disabled' do
before do
settings_to_set[:throttle_protected_paths_enabled] = false
stub_application_setting(settings_to_set)
end
it 'allows requests over the rate limit' do
(1 + requests_per_period).times do
get protected_path_that_does_not_require_authentication
expect(response).to have_http_status 200
end
end
end
context 'when protected paths throttle is enabled' do
before do
settings_to_set[:throttle_protected_paths_enabled] = true
stub_application_setting(settings_to_set)
end
it 'rejects requests over the rate limit' do
requests_per_period.times do
get protected_path_that_does_not_require_authentication
expect(response).to have_http_status 200
end
expect_rejection { get protected_path_that_does_not_require_authentication }
end
context 'when Omnibus throttle is present' do
before do
allow(Gitlab::Throttle)
.to receive(:omnibus_protected_paths_present?).and_return(true)
end
it 'allows requests over the rate limit' do
(1 + requests_per_period).times do
get protected_path_that_does_not_require_authentication
expect(response).to have_http_status 200
end
end
end
end
end
context 'API requests authenticated with personal access token', :api do
let(:user) { create(:user) }
let(:token) { create(:personal_access_token, user: user) }
let(:other_user) { create(:user) }
let(:other_user_token) { create(:personal_access_token, user: other_user) }
let(:throttle_setting_prefix) { 'throttle_protected_paths' }
let(:api_partial_url) { '/users' }
let(:protected_paths) do
[
'/api/v4/users'
]
end
before do
settings_to_set[:protected_paths] = protected_paths
stub_application_setting(settings_to_set)
end
context 'with the token in the query string' do
let(:get_args) { [api(api_partial_url, personal_access_token: token)] }
let(:other_user_get_args) { [api(api_partial_url, personal_access_token: other_user_token)] }
it_behaves_like 'rate-limited token-authenticated requests'
end
context 'with the token in the headers' do
let(:get_args) { api_get_args_with_token_headers(api_partial_url, personal_access_token_headers(token)) }
let(:other_user_get_args) { api_get_args_with_token_headers(api_partial_url, personal_access_token_headers(other_user_token)) }
it_behaves_like 'rate-limited token-authenticated requests'
end
context 'when Omnibus throttle is present' do
let(:get_args) { [api(api_partial_url, personal_access_token: token)] }
let(:other_user_get_args) { [api(api_partial_url, personal_access_token: other_user_token)] }
before do
settings_to_set[:"#{throttle_setting_prefix}_requests_per_period"] = requests_per_period
settings_to_set[:"#{throttle_setting_prefix}_period_in_seconds"] = period_in_seconds
settings_to_set[:"#{throttle_setting_prefix}_enabled"] = true
stub_application_setting(settings_to_set)
allow(Gitlab::Throttle)
.to receive(:omnibus_protected_paths_present?).and_return(true)
end
it 'allows requests over the rate limit' do
(1 + requests_per_period).times do
get(*get_args)
expect(response).to have_http_status 200
end
end
end
end
describe 'web requests authenticated with regular login' do
let(:throttle_setting_prefix) { 'throttle_protected_paths' }
let(:user) { create(:user) }
let(:url_that_requires_authentication) { '/dashboard/snippets' }
let(:protected_paths) do
[
url_that_requires_authentication
]
end
before do
settings_to_set[:protected_paths] = protected_paths
stub_application_setting(settings_to_set)
end
it_behaves_like 'rate-limited web authenticated requests'
context 'when Omnibus throttle is present' do
before do
settings_to_set[:"#{throttle_setting_prefix}_requests_per_period"] = requests_per_period
settings_to_set[:"#{throttle_setting_prefix}_period_in_seconds"] = period_in_seconds
settings_to_set[:"#{throttle_setting_prefix}_enabled"] = true
stub_application_setting(settings_to_set)
allow(Gitlab::Throttle)
.to receive(:omnibus_protected_paths_present?).and_return(true)
login_as(user)
end
it 'allows requests over the rate limit' do
(1 + requests_per_period).times do
get url_that_requires_authentication
expect(response).to have_http_status 200
end
end
end
end
end
2017-10-11 19:39:58 -04:00
end