We will be using rack attack to show how tracking and throttling is done as a part of the rate limiting feature.

As the names mean, tracking means that we are simply tracking the requests that match a particular condition and not doing any sort of blocking. We can log these and find out more information about how many requests we are getting that match a certain condition. For example, we can log requests that hit a certain limit for certain paths per request ip or request session id. Throttling is where the rate limiting actually takes place. We have certain parameters here like limit, period and the discriminator. The limit parameter shows the maximum number of requests that can be allowed within a period that is dictated by the period parameter. Then we simply put in the discriminator which tells rack attack by what we are filtering the requests to count them.

View the readme and explain

Demo

• Tracking requests that are in routes.rb

track('req_ip', :limit => 3, :period => 60) do |req|
    req.ip if path_exists?(req)
end

• Throttling requests that are not in routes.rb

throttle('throttle_req_not_in_routes', :limit => 5, :period => 60) do |req|
    if !req.path.include?("/images/") and !req.path.include?("/svg/") and !req.path.include?("/img/")
      req.ip unless path_exists?(req)
    end
  end