rack_attack.rb

Rack::Attack.blocklist('block all outer routes ') do |request|
  # Requests are blocked if the return value is truthy
  routes_array = Rails.application.routes.routes.flat_map { |r| r.path.spec.to_s }.uniq.map { |path| path&.gsub('(.:format)', '') }
  # allow assets url
  if request.path.start_with?('/assets')
    false
  else
    !routes_array.include?(request.path)
  end
end

# display custom error page
Rack::Attack.blocklisted_response = lambda do |_env|
  html = ActionView::Base.empty.render(file: 'public/500.html')
  [403, {'Content-Type' => 'text/html'}, [html]]
end