rack/rack-attack
Rack Attack
Rack-attack 是一个用于 Rack 接口的中间件，提供速率限制和请求过滤功能。它提供了一套用于限制 HTTP 请求和维护 IP 地址黑名单的系统，以保护应用程序免受恶意流量和拒绝服务攻击。
该项目通过识别并拒绝来自被封禁客户端或滥用 IP 地址的请求，实现了应用层的 DDoS 防御和 API 速率限制管理。它允许定义白名单以绕过过滤器，并使用自定义逻辑来确定是否应封禁或限制某个客户端。
该工具涵盖了全面的流量管理功能，包括自动封禁客户端、指数退避策略以及定义自定义拒绝响应的能力。它还包含用于监控请求模式的仪表化功能，并支持外部缓存后端以在分布式应用实例间同步状态。
Features
- Request Rate Limiting - Controls the number of requests a client can make within a specific timeframe to prevent system overload.
- Request Interception Middleware - Intercepts incoming HTTP requests in a middleware pipeline to evaluate security rules before application processing.
- External State Stores - Integrates with external state stores to maintain ban records and request counts across distributed instances.
- Distributed Rate Limit Stores - Provides external cache backend integration to synchronize rate limiting state across distributed application instances.
- Traffic Throttling - Limits request rates based on unique identifiers to prevent system overload and mitigate DoS attacks.
- Automated IP Banning - Automatically blocks clients for a set duration after they exceed thresholds for forbidden requests or failures.
- Malicious Traffic Blocking - Identifies and rejects requests from banned IP addresses or abusive clients before they reach application logic.
- IP Blocking Middleware - Ships middleware that rejects traffic from forbidden IP addresses and subnets to protect the application.
- Predicate-Based Request Filtering - Evaluates incoming requests against custom truthy logic blocks to determine safelisting, blocking, or throttling.
- IP-Based Rate Limiting - Tracks request frequency using unique identifiers like IP addresses to apply granular per-user quotas.
- Middleware Rate Limiters - Provides a middleware layer for the Rack interface to throttle HTTP requests and block abusive clients.
- IP Address Blocklists - Maintains blocklists to identify and reject traffic from specific banned IP addresses.
- API Rate Limiting - Provides tools for managing API request quotas and communicating limits via standard HTTP headers.
- Rack Request Filters - Implements a filtering mechanism for Rack applications to evaluate requests against security rules and safelists.
- Quota Status Headers - Implements HTTP response headers that communicate remaining request quotas and retry delays to API clients.
- Throttled Response Customization - Allows defining custom HTTP response objects, status codes, and headers for blocklisted or throttled requests.
- DDoS Protections - Protects Rack-based web applications from DDoS attacks by managing request rates and blocking abusive clients.
- Request Safelisting - Permits trusted clients or specific requests to bypass all security filters and rate limits.
- Layered Throttle Compositions - Implements layered throttle composition to apply multiple time-window limits for exponential backoff strategies.
- Server-Side Backoff Enforcement - Implements layered throttles that progressively increase the wait time between requests for abusive clients.
- Pipeline Short-Circuiting - Immediately returns custom HTTP responses when a request matches a blocklist, terminating the pipeline early.
