rack-attack 5.0.0.beta1 → 5.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: f610566e30822bb7e044db96673364461ab144bc
-  data.tar.gz: 0c455cc58bdc60917bcf26f8d9a50323c96f9237
+  metadata.gz: ef73037a3db9840b433aeb5a0d185f95edeef9be
+  data.tar.gz: 98bbf2ea7bbad24f423ff21bf2da4ce4a4f13fc9
 SHA512:
-  metadata.gz: 23256e856a36a8a0b37d2617f33ef2ba21032de6053a062d77f2ac035c5e5bde34c463c44d2d3b1c0546b079d7a01a0e005be0cf142d54870eaef64af4f56c6e
-  data.tar.gz: 9645bcc5b224881e1348e4c97e8ada425ea768c0d7e851c3d022863ba6a01bb31b9e0b942e35c914152ee17775c4d305f893820f3df32392d1d46dd372670371
+  metadata.gz: 0c796ea400d3425a0111f16d78efc883113f1fd2a3f55ba624c089978b39235f4851ffe2b546da7b1fe4fce181eea3cff9644185dbb36c373ce22bff3011ddd3
+  data.tar.gz: a89e8d96ba25124d062d6da2665827d85773876705310a364a6cc74c90e1349c3d5efed63065846770ffd1c0c537fd0a9756539c6d77f8473653c4d7e20f5940

data/README.md

@@ -230,19 +230,40 @@ Rack::Attack.blocklisted_response = lambda do |env|
 end
 
 Rack::Attack.throttled_response = lambda do |env|
-  # name and other data about the matched throttle
-  body = [
-    env['rack.attack.matched'],
-    env['rack.attack.match_type'],
-    env['rack.attack.match_data']
-  ].inspect
+  # NB: you have access to the name and other data about the matched throttle
+  #  env['rack.attack.matched'],
+  #  env['rack.attack.match_type'],
+  #  env['rack.attack.match_data']
 
   # Using 503 because it may make attacker think that they have successfully
   # DOSed the site. Rack::Attack returns 429 for throttling by default
-  [ 503, {}, [body]]
+  [ 503, {}, ["Server Error\n"]]
 end
 ```
 
+### X-RateLimit headers for well-behaved clients
+
+While Rack::Attack's primary focus is minimizing harm from abusive clients, it
+can also be used to return rate limit data that's helpful for well-behaved clients.
+
+Here's an example response that includes conventional `X-RateLimit-*` headers:
+
+```ruby
+Rack::Attack.throttled_response = lambda do |env|
+  now = Time.now
+  match_data = env['rack.attack.match_data']
+
+  headers = {
+    'X-RateLimit-Limit' => match_data[:limit].to_s,
+    'X-RateLimit-Remaining' => '0',
+    'X-RateLimit-Reset' => (now + (match_data[:period] - now.to_i % match_data[:period])).to_s
+  }
+
+  [ 429, headers, ["Throttled\n"]]
+end
+```
+
+
 For responses that did not exceed a throttle limit, Rack::Attack annotates the env with match data:
 
 ```ruby

data/lib/rack/attack/version.rb

@@ -1,5 +1,5 @@
 module Rack
   class Attack
-    VERSION = '5.0.0.beta1'
+    VERSION = '5.0.0'
   end
 end

data/spec/integration/offline_spec.rb

@@ -1,5 +1,5 @@
 require 'active_support/cache'
-require 'active_support/cache/redis_store'
+require 'redis-activesupport'
 require 'dalli'
 require_relative '../spec_helper'
 

data/spec/rack_attack_throttle_spec.rb

@@ -85,3 +85,25 @@ describe 'Rack::Attack.throttle with period as proc' do
     end
   end
 end
+
+describe 'Rack::Attack.throttle with block retuning nil' do
+  before do
+    @period = 60
+    Rack::Attack.cache.store = ActiveSupport::Cache::MemoryStore.new
+    Rack::Attack.throttle('ip/sec', :limit => 1, :period => @period) { |_| nil }
+  end
+
+  allow_ok_requests
+
+  describe 'a single request' do
+    before { get '/', {}, 'REMOTE_ADDR' => '1.2.3.4' }
+    it 'should not set the counter' do
+      key = "rack::attack:#{Time.now.to_i/@period}:ip/sec:1.2.3.4"
+      Rack::Attack.cache.store.read(key).must_equal nil
+    end
+
+    it 'should not populate throttle data' do
+      last_request.env['rack.attack.throttle_data'].must_equal nil
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack-attack
 version: !ruby/object:Gem::Version
-  version: 5.0.0.beta1
+  version: 5.0.0
 platform: ruby
 authors:
 - Aaron Suggs
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-07-05 00:00:00.000000000 Z
+date: 2016-08-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -215,9 +215,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: 2.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements: []
 rubyforge_project: 
 rubygems_version: 2.5.1