kotovalexarian-likes-gitlab
/
gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Include API session route under rack protection 

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
This commit is contained in:
Dmitriy Zaporozhets 2013-11-25 18:24:45 +02:00
parent 0461760f21
commit 47e8c67d1d
No known key found for this signature in database
GPG Key ID: 2CEAFD2671262EC2
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
config/initializers/rack_attack.rb.example
View File

@ -5,11 +5,13 @@
paths_to_be_protected = [
"#{Rails.application.config.relative_url_root}/users/password",
"#{Rails.application.config.relative_url_root}/users/sign_in",
"#{Rails.application.config.relative_url_root}/api/#{API::API.version}/session.json",
"#{Rails.application.config.relative_url_root}/api/#{API::API.version}/session",
"#{Rails.application.config.relative_url_root}/users"
]
unless Rails.env.test?
Rack::Attack.throttle('protected paths', limit: 6, period: 60.seconds) do |req|
Rack::Attack.throttle('protected paths', limit: 10, period: 60.seconds) do |req|
req.ip if paths_to_be_protected.include?(req.path) && req.post?
end
end