Skip to content

Instantly share code, notes, and snippets.

@kananinirav

kananinirav/rack_attack.rb Secret

Created August 6, 2022 07:48
Download ZIP

Revisions

  1. kananinirav created this gist Aug 6, 2022.
    12 changes: 12 additions & 0 deletions rack_attack.rb
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,12 @@
    # config/initializers/rack_attack.rb (for rails apps)
    # Provided that trusted users use an HTTP request header named APIKey
    Rack::Attack.safelist('mark any authenticated access safe') do |request|
    # Requests are allowed if the return value is truthy
    request.env['HTTP_APIKEY'] == 'secret-string'
    end
    # Always allow requests from localhost
    # (blocklist & throttles are skipped)
    Rack::Attack.safelist('allow from localhost') do |req|
    # Requests are allowed if the return value is truthy
    '127.0.0.1' == req.ip || '::1' == req.ip
    end