rack/rack-attack
Rack Attack
Rack-attack ist ein Middleware-Rate-Limiter und Request-Filter für das Rack-Interface. Es bietet ein System zur Drosselung von HTTP-Anfragen und zur Verwaltung von IP-Blocklisten, um Anwendungen vor schädlichem Traffic und Denial-of-Service-Angriffen zu schützen.
Das Projekt ermöglicht DDoS-Mitigation auf Anwendungsebene und das Management von API-Rate-Limits, indem Anfragen von gesperrten Clients oder missbräuchlichen IP-Adressen identifiziert und abgelehnt werden. Es erlaubt die Definition von Safelists, um Filter zu umgehen, und nutzt benutzerdefinierte Logik, um zu entscheiden, ob ein Client blockiert oder gedrosselt werden soll.
Das Tool deckt umfassendes Traffic-Management durch automatisiertes Client-Banning, Exponential-Backoff-Strategien und die Möglichkeit zur Definition eigener Ablehnungsantworten ab. Es enthält Instrumentierung zur Überwachung von Request-Mustern und unterstützt externe Cache-Backends zur Synchronisierung des Zustands über verteilte Anwendungsinstanzen hinweg.
Features
- Request Rate Limiting - Controls the number of requests a client can make within a specific timeframe to prevent system overload.
- Request Interception Middleware - Intercepts incoming HTTP requests in a middleware pipeline to evaluate security rules before application processing.
- External State Stores - Integrates with external state stores to maintain ban records and request counts across distributed instances.
- Distributed Rate Limit Stores - Provides external cache backend integration to synchronize rate limiting state across distributed application instances.
- Traffic Throttling - Limits request rates based on unique identifiers to prevent system overload and mitigate DoS attacks.
- Automated IP Banning - Automatically blocks clients for a set duration after they exceed thresholds for forbidden requests or failures.
- Malicious Traffic Blocking - Identifies and rejects requests from banned IP addresses or abusive clients before they reach application logic.
- IP Blocking Middleware - Ships middleware that rejects traffic from forbidden IP addresses and subnets to protect the application.
- Predicate-Based Request Filtering - Evaluates incoming requests against custom truthy logic blocks to determine safelisting, blocking, or throttling.
- IP-Based Rate Limiting - Tracks request frequency using unique identifiers like IP addresses to apply granular per-user quotas.
- Middleware Rate Limiters - Provides a middleware layer for the Rack interface to throttle HTTP requests and block abusive clients.
- IP Address Blocklists - Maintains blocklists to identify and reject traffic from specific banned IP addresses.
- API Rate Limiting - Provides tools for managing API request quotas and communicating limits via standard HTTP headers.
- Rack Request Filters - Implements a filtering mechanism for Rack applications to evaluate requests against security rules and safelists.
- Quota Status Headers - Implements HTTP response headers that communicate remaining request quotas and retry delays to API clients.
- Throttled Response Customization - Allows defining custom HTTP response objects, status codes, and headers for blocklisted or throttled requests.
- DDoS Protections - Protects Rack-based web applications from DDoS attacks by managing request rates and blocking abusive clients.
- Request Safelisting - Permits trusted clients or specific requests to bypass all security filters and rate limits.
- Layered Throttle Compositions - Implements layered throttle composition to apply multiple time-window limits for exponential backoff strategies.
- Server-Side Backoff Enforcement - Implements layered throttles that progressively increase the wait time between requests for abusive clients.
- Pipeline Short-Circuiting - Immediately returns custom HTTP responses when a request matches a blocklist, terminating the pipeline early.
