Apply a 25x rate limit by IP even to authenticated requests (#5948)

diff --git a/app/controllers/concerns/rate_limit_headers.rb b/app/controllers/concerns/rate_limit_headers.rb
index ac9b58f5dfb47f9667755c95b1efef29bb56651c..b79c558d8157ec95a1ba25b266d4addf42b07fa1 100644 (file)
--- a/app/controllers/concerns/rate_limit_headers.rb
+++ b/app/controllers/concerns/rate_limit_headers.rb
@@ -44,8 +44,8 @@ module RateLimitHeaders
   end
 
   def api_throttle_data
-    request.env['rack.attack.throttle_data']['throttle_authenticated_api'] ||
-      request.env['rack.attack.throttle_data']['throttle_unauthenticated_api']
+    most_limited_type, = request.env['rack.attack.throttle_data'].min_by { |_, v| v[:limit] }
+    request.env['rack.attack.throttle_data'][most_limited_type]
   end
 
   def request_time

diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb
index 41db769293d27b782a0b9a8d4153de219f70d894..b38fb302b2eb2ef4c81549a1346a227855671cb8 100644 (file)
--- a/config/initializers/rack_attack.rb
+++ b/config/initializers/rack_attack.rb
@@ -49,8 +49,8 @@ class Rack::Attack
     req.api_request? && req.authenticated_user_id
   end
 
-  throttle('throttle_unauthenticated_api', limit: 300, period: 5.minutes) do |req|
-    req.ip if req.api_request? && req.unauthenticated?
+  throttle('throttle_unauthenticated_api', limit: 7_500, period: 5.minutes) do |req|
+    req.ip if req.api_request?
   end
 
   throttle('protected_paths', limit: 5, period: 5.minutes) do |req|