rack-attack 1.3.1 → 1.3.2

data/README.md

@@ -1,10 +1,10 @@
 # Rack::Attack!!!
-*A DSL for blocking & thottling abusive clients*
+*A DSL for blocking & throttling abusive clients*
 
 Rack::Attack is a rack middleware to protect your web app from bad clients.
-It allows *whitelisting*, *blacklisting*, and *thottling* based on arbitrary properties of the request.
+It allows *whitelisting*, *blacklisting*, and *throttling* based on arbitrary properties of the request.
 
-Thottle state is stored in a configurable cache (e.g. `Rails.cache`), presumably backed by memcached.
+Throttle state is stored in a configurable cache (e.g. `Rails.cache`), presumably backed by memcached.
 
 ## Installation
 
@@ -28,7 +28,7 @@ Optionally configure the cache store for throttling:
 
     Rack::Attack.cache.store = ActiveSupport::Cache::MemoryStore.new # defaults to Rails.cache
 
-Note that `Rack::Attack.cache` is only used for throttling, not blacklisting & whitelisting. Your cache store must implement `increment` and `write` like [ActiveSupport::Cache::Store](http://api.rubyonrails.org/classes/ActiveSupport/Cache/Store.html).
+Note that `Rack::Attack.cache` is only used for throttling; not blacklisting & whitelisting. Your cache store must implement `increment` and `write` like [ActiveSupport::Cache::Store](http://api.rubyonrails.org/classes/ActiveSupport/Cache/Store.html).
 
 ## How it works
 
@@ -40,8 +40,8 @@ The Rack::Attack middleware compares each request against *whitelists*, *blackli
 
 ## Usage
 
-Define blacklists, throttles, and whitelists.
-Note that `req` is a [Rack::Request](http://rack.rubyforge.org/doc/classes/Rack/Request.html) object.
+Define blacklists, throttles, and whitelists as blocks that return truthy of falsy values.
+A [Rack::Request](http://rack.rubyforge.org/doc/classes/Rack/Request.html) object is passed to the block (named 'req' in the examples).
 
 ### Blacklists
 
@@ -53,23 +53,25 @@ Note that `req` is a [Rack::Request](http://rack.rubyforge.org/doc/classes/Rack/
 
     # Block logins from a bad user agent
     Rack::Attack.blacklist('block bad UA logins') do |req|
-      req.post? && request.path == '/login' && req.user_agent == 'BadUA'
+      req.path == '/login' && req.post? && req.user_agent == 'BadUA'
     end
 
 ### Throttles
 
     # Throttle requests to 5 requests per second per ip
     Rack::Attack.throttle('req/ip', :limit => 5, :period => 1.second) do |req|
-      # If the return value is truthy, the cache key for
-      # "rack::attack:#{Time.now.to_i/1.second}:req/ip:#{req.ip}"
-      # is incremented and compared with the limit.
-      # If falsy, the cache key is neither incremented or checked.
+      # If the return value is truthy, the cache key for the return value
+      # is incremented and compared with the limit. In this case:
+      #   "rack::attack:#{Time.now.to_i/1.second}:req/ip:#{req.ip}"
+      #
+      # If falsy, the cache key is neither incremented nor checked.
+
       req.ip
     end
 
     # Throttle login attempts for a given email parameter to 6 reqs/minute
     Rack::Attack.throttle('logins/email', :limit => 6, :period => 60.seconds) do |req|
-      req.post? && request.path == '/login' && req.params['email']
+      request.path == '/login' && req.post? && req.params['email']
     end
 
 ### Whitelists
@@ -124,7 +126,7 @@ It is impractical if not impossible to block abusive clients completely.
 Rack::Attack aims to let developers quickly mitigate abusive requests and rely
 less on short-term, one-off hacks to block a particular attack.
 
-Rack::Attack complements `iptables` and nginx's [limit_zone module](http://wiki.nginx.org/HttpLimitZoneModule).
+Rack::Attack complements tools like iptables and nginx's [limit_zone module](http://wiki.nginx.org/HttpLimitZoneModule).
 
 [![Travis CI](https://secure.travis-ci.org/ktheory/rack-attack.png)](http://travis-ci.org/ktheory/rack-attack)
 

data/lib/rack/attack/cache.rb

@@ -11,7 +11,7 @@ module Rack
       def count(unprefixed_key, period)
         epoch_time = Time.now.to_i
         expires_in = period - (epoch_time % period)
-        key = "#{prefix}:#{epoch_time/period}:#{unprefixed_key}"
+        key = "#{prefix}:#{(epoch_time/period).to_i}:#{unprefixed_key}"
         result = store.increment(key, 1, :expires_in => expires_in)
         # NB: Some stores return nil when incrementing uninitialized values
         if result.nil?

data/lib/rack/attack/version.rb

@@ -1,5 +1,5 @@
 module Rack
   module Attack
-    VERSION = '1.3.1'
+    VERSION = '1.3.2'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack-attack
 version: !ruby/object:Gem::Version
-  version: 1.3.1
+  version: 1.3.2
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-08-09 00:00:00.000000000 Z
+date: 2012-08-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack