rack/rack-attack
Rack Attack
Rack-attack هو برنامج وسيط (middleware) لتحديد معدل الطلبات وفلترتها لواجهة Rack. يوفر نظاماً لتقييد طلبات HTTP والحفاظ على قوائم حظر لعناوين IP لحماية التطبيقات من الزيارات الضارة وهجمات حجب الخدمة (DoS).
يُمكّن المشروع من تخفيف هجمات DDoS على مستوى التطبيق وإدارة حدود معدل طلبات API من خلال تحديد ورفض الطلبات القادمة من عملاء محظورين أو عناوين IP مسيئة. كما يسمح بتعريف قوائم سماح لتجاوز الفلاتر، ويستخدم منطقاً مخصصاً لتحديد ما إذا كان يجب حظر العميل أو تقييد معدل طلباته.
يغطي الأداة إدارة شاملة لحركة المرور من خلال حظر العملاء تلقائياً، واستراتيجيات التراجع الأسي (exponential backoff)، والقدرة على تحديد استجابات رفض مخصصة. كما يتضمن أدوات لمراقبة أنماط الطلبات ويدعم أنظمة تخزين مؤقت خارجية لمزامنة الحالة عبر مثيلات التطبيقات الموزعة.
Features
- Request Rate Limiting - Controls the number of requests a client can make within a specific timeframe to prevent system overload.
- Request Interception Middleware - Intercepts incoming HTTP requests in a middleware pipeline to evaluate security rules before application processing.
- External State Stores - Integrates with external state stores to maintain ban records and request counts across distributed instances.
- Distributed Rate Limit Stores - Provides external cache backend integration to synchronize rate limiting state across distributed application instances.
- Traffic Throttling - Limits request rates based on unique identifiers to prevent system overload and mitigate DoS attacks.
- Automated IP Banning - Automatically blocks clients for a set duration after they exceed thresholds for forbidden requests or failures.
- Malicious Traffic Blocking - Identifies and rejects requests from banned IP addresses or abusive clients before they reach application logic.
- IP Blocking Middleware - Ships middleware that rejects traffic from forbidden IP addresses and subnets to protect the application.
- Predicate-Based Request Filtering - Evaluates incoming requests against custom truthy logic blocks to determine safelisting, blocking, or throttling.
- IP-Based Rate Limiting - Tracks request frequency using unique identifiers like IP addresses to apply granular per-user quotas.
- Middleware Rate Limiters - Provides a middleware layer for the Rack interface to throttle HTTP requests and block abusive clients.
- IP Address Blocklists - Maintains blocklists to identify and reject traffic from specific banned IP addresses.
- API Rate Limiting - Provides tools for managing API request quotas and communicating limits via standard HTTP headers.
- Rack Request Filters - Implements a filtering mechanism for Rack applications to evaluate requests against security rules and safelists.
- Quota Status Headers - Implements HTTP response headers that communicate remaining request quotas and retry delays to API clients.
- Throttled Response Customization - Allows defining custom HTTP response objects, status codes, and headers for blocklisted or throttled requests.
- DDoS Protections - Protects Rack-based web applications from DDoS attacks by managing request rates and blocking abusive clients.
- Request Safelisting - Permits trusted clients or specific requests to bypass all security filters and rate limits.
- Layered Throttle Compositions - Implements layered throttle composition to apply multiple time-window limits for exponential backoff strategies.
- Server-Side Backoff Enforcement - Implements layered throttles that progressively increase the wait time between requests for abusive clients.
- Pipeline Short-Circuiting - Immediately returns custom HTTP responses when a request matches a blocklist, terminating the pipeline early.
