kotovalexarian-likes-gitlab/gitlab-org--gitlab-foss
1
0
Fork 0
Code Releases Activity

Include API session route under rack protection

Browse source 
Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
This commit is contained in:
Dmitriy Zaporozhets 2013-11-25 18:24:45 +02:00
parent 0461760f21
commit 47e8c67d1d
No known key found for this signature in database
GPG key ID: 2CEAFD2671262EC2
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
config/initializers/rack_attack.rb.example
View file

@ -5,11 +5,13 @@
paths_to_be_protected = [ paths_to_be_protected = [
"#{Rails.application.config.relative_url_root}/users/password", "#{Rails.application.config.relative_url_root}/users/password",
"#{Rails.application.config.relative_url_root}/users/sign_in", "#{Rails.application.config.relative_url_root}/users/sign_in",
"#{Rails.application.config.relative_url_root}/api/#{API::API.version}/session.json",
"#{Rails.application.config.relative_url_root}/api/#{API::API.version}/session",
"#{Rails.application.config.relative_url_root}/users" "#{Rails.application.config.relative_url_root}/users"
] ]
unless Rails.env.test? unless Rails.env.test?
Rack::Attack.throttle('protected paths', limit: 6, period: 60.seconds) do |req| Rack::Attack.throttle('protected paths', limit: 10, period: 60.seconds) do |req|
req.ip if paths_to_be_protected.include?(req.path) && req.post? req.ip if paths_to_be_protected.include?(req.path) && req.post?
end end
end end