fef/nyastodon
1
1
Fork 0
forked from mirrors/catstodon
Code Issues Pull requests Projects Releases Packages Wiki Activity

Make rate limits even less strict

Browse source
This commit is contained in:
Jeremy Kescher 2022-06-12 23:18:03 +02:00
parent a2383b89e2
commit a6d7063be9
No known key found for this signature in database
GPG key ID: 48DFE4BB15BA5940
2 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
app/lib/rate_limiter.rb
View file

@ -11,7 +11,7 @@ class RateLimiter
statuses: {
limit: 300,
period: 1.hours.freeze,
period: 1.hour.freeze,
}.freeze,
reports: {

10
config/initializers/rack_attack.rb
View file

@ -46,7 +46,7 @@ class Rack::Attack
IpBlock.blocked?(req.remote_ip)
end
throttle('throttle_authenticated_api', limit: 300, period: 5.minutes) do |req|
throttle('throttle_authenticated_api', limit: 600, period: 5.minutes) do |req|
req.authenticated_user_id if req.api_request?
end
@ -54,11 +54,11 @@ class Rack::Attack
req.remote_ip if req.api_request? && req.unauthenticated?
end
throttle('throttle_api_media', limit: 30, period: 30.minutes) do |req|
throttle('throttle_api_media', limit: 100, period: 30.minutes) do |req|
req.authenticated_user_id if req.post? && req.path.match?('^/api/v\d+/media')
end
throttle('throttle_media_proxy', limit: 30, period: 10.minutes) do |req|
throttle('throttle_media_proxy', limit: 200, period: 10.minutes) do |req|
req.remote_ip if req.path.start_with?('/media_proxy')
end
@ -66,7 +66,7 @@ class Rack::Attack
req.remote_ip if req.post? && req.path == '/api/v1/accounts'
end
throttle('throttle_authenticated_paging', limit: 300, period: 15.minutes) do |req|
throttle('throttle_authenticated_paging', limit: 1000, period: 15.minutes) do |req|
req.authenticated_user_id if req.paging_request?
end
@ -77,7 +77,7 @@ class Rack::Attack
API_DELETE_REBLOG_REGEX = /\A\/api\/v1\/statuses\/[\d]+\/unreblog/.freeze
API_DELETE_STATUS_REGEX = /\A\/api\/v1\/statuses\/[\d]+/.freeze
throttle('throttle_api_delete', limit: 30, period: 30.minutes) do |req|
throttle('throttle_api_delete', limit: 30, period: 5.minutes) do |req|
req.authenticated_user_id if (req.post? && req.path.match?(API_DELETE_REBLOG_REGEX)) || (req.delete? && req.path.match?(API_DELETE_STATUS_REGEX))
end