0

I have gem rack-attack setup for my app. I want to start throttling basic auth authentication based on IP.

My basic auth code setup like so:

# config/environments/production.rb
config.middleware.insert_after(::Rack::Lock, '::Rack::Auth::Basic', ENV['RAILS_ENV') do |u, p|
  [u, p] == [ENV['BASIC_AUTH_USERNAME'], ENV['BASIC_AUTH_PASSWORD']]
end

I'd imagine my rack attack would contain something like this:

# config/initializers/rack_attack.rb
Rack::Attack.throttle('req/ip', limit: 2, period: 60.seconds) do |req| req.ip 
    # what should belong here???
end
Jonathan Mui
  • 2,471
  • 3
  • 19
  • 27

1 Answers1

0

Please see my github comment about this question.

ktheory
  • 1,101
  • 7
  • 6