3

I used the example throttle code for Rack::Attack.

throttle('req/ip', limit: 100, period: 5.minutes) do |req|
  req.ip unless req.path.starts_with?('/assets')
end

This worked great on our staging server but immediately ran into the limit on production because req.ip returns the IP address of our load balancer and not the remote_ip of the client.

Note that remote_ip is a method in ActionDispatch::Request but not Rack::Attack::Request.

We are using Rails 3.2.2 on Ruby 2.2.

Kevin Lawrence
  • 698
  • 7
  • 23

1 Answers1

5

I was able to get it working by adding a method to Rack::Attack::Request

class Rack::Attack
  class Request < ::Rack::Request
    def remote_ip
      @remote_ip ||= (env['action_dispatch.remote_ip'] || ip).to_s
    end
  end
end

then using 

req.remote_ip unless req.path.starts_with?('/assets')
Kevin Lawrence
  • 698
  • 7
  • 23