rack/rack-attack
Rack Attack
Rack-attack is a middleware rate limiter and request filter for the Rack interface. It provides a system for throttling HTTP requests and maintaining IP address blocklists to protect applications from malicious traffic and denial-of-service attacks.
The project enables application layer DDoS mitigation and API rate limit management by identifying and rejecting requests from banned clients or abusive IP addresses. It allows for the definition of safelists to bypass filters and uses custom logic to determine if a client should be blocked or throttled.
The tool covers comprehensive traffic management through automated client banning, exponential backoff strategies, and the ability to define custom rejection responses. It includes instrumentation for monitoring request patterns and supports external cache backends to synchronize state across distributed application instances.
Features
- Request Rate Limiting - Controls the number of requests a client can make within a specific timeframe to prevent system overload.
- Request Interception Middleware - Intercepts incoming HTTP requests in a middleware pipeline to evaluate security rules before application processing.
- External State Stores - Integrates with external state stores to maintain ban records and request counts across distributed instances.
- Distributed Rate Limit Stores - Provides external cache backend integration to synchronize rate limiting state across distributed application instances.
- Traffic Throttling - Limits request rates based on unique identifiers to prevent system overload and mitigate DoS attacks.
- Automated IP Banning - Automatically blocks clients for a set duration after they exceed thresholds for forbidden requests or failures.
- Malicious Traffic Blocking - Identifies and rejects requests from banned IP addresses or abusive clients before they reach application logic.
- IP Blocking Middleware - Ships middleware that rejects traffic from forbidden IP addresses and subnets to protect the application.
- Predicate-Based Request Filtering - Evaluates incoming requests against custom truthy logic blocks to determine safelisting, blocking, or throttling.
- IP-Based Rate Limiting - Tracks request frequency using unique identifiers like IP addresses to apply granular per-user quotas.
- Middleware Rate Limiters - Provides a middleware layer for the Rack interface to throttle HTTP requests and block abusive clients.
- IP Address Blocklists - Maintains blocklists to identify and reject traffic from specific banned IP addresses.
- API Rate Limiting - Provides tools for managing API request quotas and communicating limits via standard HTTP headers.
- Rack Request Filters - Implements a filtering mechanism for Rack applications to evaluate requests against security rules and safelists.
- Quota Status Headers - Implements HTTP response headers that communicate remaining request quotas and retry delays to API clients.
- Throttled Response Customization - Allows defining custom HTTP response objects, status codes, and headers for blocklisted or throttled requests.
- DDoS Protections - Protects Rack-based web applications from DDoS attacks by managing request rates and blocking abusive clients.
- Request Safelisting - Permits trusted clients or specific requests to bypass all security filters and rate limits.
- Layered Throttle Compositions - Implements layered throttle composition to apply multiple time-window limits for exponential backoff strategies.
- Server-Side Backoff Enforcement - Implements layered throttles that progressively increase the wait time between requests for abusive clients.
- Pipeline Short-Circuiting - Immediately returns custom HTTP responses when a request matches a blocklist, terminating the pipeline early.
