Security: rack-attack
This course covers rate limiting for a Rails application, built around the repository's own sign-in, signup and password reset endpoints. It explains credential stuffing and other automated traffic, and where limits can sit: the edge, the proxy or the application. It compares Rails' built-in rate_limit with the Rack::Attack middleware and its safelist, blocklist, throttle and track rules. It also covers choosing what to count by, picking a shared store for counters, returning 429 with Retry-After, logging throttles, and rolling out rules in track mode first.
What you'll learn
- ✓Why credential stuffing calls for limiting attempts, and what rate limiting cannot stop
- ✓How Rails' rate_limit and Rack::Attack differ, and when to use both
- ✓How to choose a discriminator: IP, account, API key or subnet
- ✓Why the counter store must be shared and survive an attack
- ✓How to respond with 429 and Retry-After, and log throttles by rule name
- ✓How to roll out limits in track mode and test them with the limiter enabled
Curriculum
7 lessonsThe attack you will actually get
Explains credential stuffing and other automated traffic, what rate limiting does and does not do, and the three layers.
Rails' built-in rate_limit
Shows Rails' built-in rate_limit method, its options, its use on password resets, and what it cannot do.
Rack::Attack fundamentals
Introduces Rack::Attack as middleware, its safelist, blocklist, throttle and track primitives, and a starting configuration.
Choosing the discriminator
Compares counting by IP, by the attempted account, by API key or subnet, and counting failures over requests.
The store, and what it costs
Examines where counters live, why database-backed or per-process stores cause trouble, fixed windows, and failing open or closed.
Responses, observability and tuning
Covers 429 responses with Retry-After, logs and metrics for throttles, track mode, choosing limits and testing them.
Putting it together: protecting this app
Assembles the rules for this application's auth endpoints, a staged rollout through track mode, and what limits leave unsolved.