rack/rack-attack
Rack Attack
Rack-attack est un middleware de limitation de débit (rate limiter) et un filtre de requêtes pour l'interface Rack. Il fournit un système pour brider les requêtes HTTP et maintenir des listes de blocage d'adresses IP afin de protéger les applications contre le trafic malveillant et les attaques par déni de service.
Le projet permet l'atténuation des attaques DDoS au niveau applicatif et la gestion des limites de débit des API en identifiant et en rejetant les requêtes provenant de clients bannis ou d'adresses IP abusives. Il permet de définir des listes blanches (safelists) pour contourner les filtres et utilise une logique personnalisée pour déterminer si un client doit être bloqué ou bridé.
L'outil couvre une gestion complète du trafic grâce au bannissement automatisé des clients, à des stratégies d'attente exponentielle (exponential backoff) et à la possibilité de définir des réponses de rejet personnalisées. Il inclut une instrumentation pour surveiller les modèles de requêtes et prend en charge des backends de cache externes pour synchroniser l'état entre les instances d'application distribuées.
Features
- Request Rate Limiting - Controls the number of requests a client can make within a specific timeframe to prevent system overload.
- Request Interception Middleware - Intercepts incoming HTTP requests in a middleware pipeline to evaluate security rules before application processing.
- External State Stores - Integrates with external state stores to maintain ban records and request counts across distributed instances.
- Distributed Rate Limit Stores - Provides external cache backend integration to synchronize rate limiting state across distributed application instances.
- Traffic Throttling - Limits request rates based on unique identifiers to prevent system overload and mitigate DoS attacks.
- Automated IP Banning - Automatically blocks clients for a set duration after they exceed thresholds for forbidden requests or failures.
- Malicious Traffic Blocking - Identifies and rejects requests from banned IP addresses or abusive clients before they reach application logic.
- IP Blocking Middleware - Ships middleware that rejects traffic from forbidden IP addresses and subnets to protect the application.
- Predicate-Based Request Filtering - Evaluates incoming requests against custom truthy logic blocks to determine safelisting, blocking, or throttling.
- IP-Based Rate Limiting - Tracks request frequency using unique identifiers like IP addresses to apply granular per-user quotas.
- Middleware Rate Limiters - Provides a middleware layer for the Rack interface to throttle HTTP requests and block abusive clients.
- IP Address Blocklists - Maintains blocklists to identify and reject traffic from specific banned IP addresses.
- API Rate Limiting - Provides tools for managing API request quotas and communicating limits via standard HTTP headers.
- Rack Request Filters - Implements a filtering mechanism for Rack applications to evaluate requests against security rules and safelists.
- Quota Status Headers - Implements HTTP response headers that communicate remaining request quotas and retry delays to API clients.
- Throttled Response Customization - Allows defining custom HTTP response objects, status codes, and headers for blocklisted or throttled requests.
- DDoS Protections - Protects Rack-based web applications from DDoS attacks by managing request rates and blocking abusive clients.
- Request Safelisting - Permits trusted clients or specific requests to bypass all security filters and rate limits.
- Layered Throttle Compositions - Implements layered throttle composition to apply multiple time-window limits for exponential backoff strategies.
- Server-Side Backoff Enforcement - Implements layered throttles that progressively increase the wait time between requests for abusive clients.
- Pipeline Short-Circuiting - Immediately returns custom HTTP responses when a request matches a blocklist, terminating the pipeline early.
