ruby
复制代码
gem 'rack-attack'
gem 'rack-cors'
1. rack-attack 可以根据ip、域名等设置黑名单、设置访问频率
ruby
复制代码
# 新增 config/initializers/rack_attack.rb
# 请求referer如果匹配不上设置的allowed_origins,返回403 forbidden
Rack::Attack.blocklist('block bad domains') do |req|
next if !req.path.start_with?('/admin_api/') || Rails.env.test?
Rails.application.credentials.allowed_origins.none? { |r| Regexp.new(r) =~ req.referer }
end
# EDITOR="vim" bin/rails credentials:edit
allowed_origins:
- api.xxx.net
- localhost
ruby
复制代码
class Rack::Attack
# Rack::Attack.cache.store = ActiveSupport::Cache::RedisCacheStore.new(url: "...")
Rack::Attack.cache.store = ActiveSupport::Cache::MemoryStore.new
# key: "rack::attack:#{Time.now.to_i/:period}:public_data/ip:#{req.ip}"
throttle('public_data/ip', limit: 2, period: 1.minutes) do |req|
req.ip if req.path.start_with?('/pc/v1/public_data')
end
self.throttled_responder = lambda do |_env|
[429, # status
{}, # headers
['throttling, retry later']] # body
end
end
2. rack-cors 可以根据域名、访问方法、资源设置跨域请求cors
ruby
复制代码
# config/initializers/cors.rb
Rails.application.config.middleware.insert_before 0, Rack::Cors do
allow do
origins '*'
resource '*', headers: :any, methods: [:get, :post, :put, :patch, :delete, :options, :head],
end
end
ruby
复制代码
Rails.application.config.middleware.insert_before 0, Rack::Cors do
allow do
origins 'localhost:3000', '127.0.0.1:3000',
/\Ahttp:\/\/192\.168\.0\.\d{1,3}(:\d+)?\z/
# regular expressions can be used here
resource '/file/list_all/', :headers => 'x-domain-token'
resource '/file/at/*',
methods: [:get, :post, :delete, :put, :patch, :options, :head],
headers: 'x-domain-token',
expose: ['Some-Custom-Response-Header'],
max_age: 600
# headers to expose
end
allow do
origins '*'
resource '/public/*', headers: :any, methods: :get
# Only allow a request for a specific host
resource '/api/v1/*',
headers: :any,
methods: :get,
if: proc { |env| env['HTTP_HOST'] == 'api.example.com' }
end
end