suzanne.soy/travis-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

auto banning: whitelist POST requests for in-browser handshake, on staging only ban for 10 seconds

Browse Source
This commit is contained in:
Konstantin Haase 2015-10-06 11:00:35 +02:00
parent 1bec0c1332
commit 0249140dc8
1 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
lib/travis/api/attack.rb
View File

@ -17,6 +17,20 @@ class Rack::Attack
end end
end end
def self.bantime(value)
case Travis.env
when "production" then value
when "staging" then 10 # ban for 10 seconds on staging
else 1
end
end
POST_WHITELISTED = [
"/auth/handshake",
"/auth/post_message",
"/auth/post_message/iframe"
]
#### ####
# Ban based on: IP address # Ban based on: IP address
# Ban time: indefinite # Ban time: indefinite
@ -30,7 +44,7 @@ class Rack::Attack
# Ban time: 5 hours # Ban time: 5 hours
# Ban after: 10 POST requests within five minutes to /auth/github # Ban after: 10 POST requests within five minutes to /auth/github
blacklist('hammering /auth/github') do |request| blacklist('hammering /auth/github') do |request|
Rack::Attack::Allow2Ban.filter(request.identifier, maxretry: 10, findtime: 5.minutes, bantime: 5.hours) do Rack::Attack::Allow2Ban.filter(request.identifier, maxretry: 10, findtime: 5.minutes, bantime: bantime(5.hours)) do
request.post? and request.path == '/auth/github' request.post? and request.path == '/auth/github'
end end
end end
@ -40,8 +54,8 @@ class Rack::Attack
# Ban time: 1 hour # Ban time: 1 hour
# Ban after: 10 POST requests within 30 seconds # Ban after: 10 POST requests within 30 seconds
blacklist('spamming with POST requests') do |request| blacklist('spamming with POST requests') do |request|
Rack::Attack::Allow2Ban.filter(request.identifier, maxretry: 10, findtime: 30.seconds, bantime: 1.hour) do Rack::Attack::Allow2Ban.filter(request.identifier, maxretry: 10, findtime: 30.seconds, bantime: bantime(1.hour)) do
request.post? request.post? and not POST_WHITELISTED.include? '/auth/github'
end end
end end