From 0e8819f0e8729cda54231ed7a76dd10eb2083bdf Mon Sep 17 00:00:00 2001
From: Eugen Rochko <eugen@zeonfederated.com>
Date: Sun, 7 Apr 2019 04:26:43 +0200
Subject: [PATCH] Add rate limit for media proxy requests (#10490)
30 per 30 minutes, like media uploads
---
config/initializers/rack_attack.rb | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb
index 28201cc64..ae3eede66 100644
--- a/config/initializers/rack_attack.rb
+++ b/config/initializers/rack_attack.rb
@@ -57,6 +57,10 @@ class Rack::Attack
req.authenticated_user_id if req.post? && req.path.start_with?('/api/v1/media')
end
+ throttle('throttle_media_proxy', limit: 30, period: 30.minutes) do |req|
+ req.ip if req.path.start_with?('/media_proxy')
+ end
+
throttle('throttle_api_sign_up', limit: 5, period: 30.minutes) do |req|
req.ip if req.post? && req.path == '/api/v1/accounts'
end