Rate-limit the public, unauthenticated write endpoints
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
从四个指定的 create action 开始：PublicFormsController#create、Events::PublicRegistrationsController#create、Events::BulkPaymentFormSubmissionsController#create 和 ContactUsController#create。为每个 endpoint 添加所述的 Rails 速率限制，然后在 development 中使用 memory cache 手动验证该限制；同时确认 request.remote_ip 在 production proxy 后方的行为正确。
由索引模型根据 Issue 内容生成。
描述
Four endpoints accept unauthenticated POSTs and create records / send email. None are throttled — the only defence is a hidden honeypot field, which stops naive bots but nothing deliberate.
Endpoints
| Endpoint | Controller | Creates |
|---|---|---|
POST /f/:slug |
PublicFormsController#create |
Person, FormSubmission, 2 emails |
POST /events/:event_id/public_registrations |
Events::PublicRegistrationsController#create |
Person, EventRegistration, FormSubmission, emails |
POST /events/:event_id/bulk_payment_form_submissions |
Events::BulkPaymentFormSubmissionsController#create |
Person, FormSubmission, emails |
POST /contact_us |
ContactUsController#create |
/f/:slug is the most exposed: it is always open, whereas the event endpoints are gated behind ensure_registerable.
Approach
Rails 8.1 ships ActionController::RateLimiting, so no new gem:
rate_limit to: 5, within: 1.minute, only: :create,
with: -> { redirect_to public_form_path(@form.slug), alert: "Too many submissions — please wait a minute." }
Keys on request.remote_ip by default and scopes per controller.
Storage
Uses config.cache_store, which is already suitable in both real environments:
- production —
:solid_cache_store(DB-backed, so the counter is shared across processes) - development —
:memory_store
Decided: no spec for the rate limit
Test env is :null_store, so increment no-ops and a limit never trips — it can't be spec'd without first changing the test cache store (stub Rails.cache, pass an explicit store:, or switch the env to :memory_store).
We are deliberately not doing that. Writing the spec means solving the cache-store question and adds roughly 15 minutes to every suite run for a one-line, framework-provided guard. Not worth it. Ship the rate_limit calls unspec'd and verify by hand in development (where :memory_store makes the limit live).
Revisit only if a future limit carries real logic in its by: or with: lambda.
Notes
- Confirm
request.remote_ipresolves correctly behind the production proxy before trusting per-IP keys. - Deliberately scoped as its own PR rather than folded into #2237: this is a cross-cutting policy that should cover all four endpoints at once.
- 主要语言
- Ruby
- 星标
- 15
- 派生
- 28
- 平均合并
- 1 天 12 分钟
- 30 天内合并 PR
- 262
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 提供 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
rubyforgood/awbw 的其他 Issue
-
blocked
难度 2/5 1-3 小时 新手友好度 68/100
rubyforgood/awbw#2824 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 82/100
rubyforgood/awbw#2822 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
rubyforgood/awbw#2160 ·
维护者通常 1 天内回复
-
Update callout faq defualt text when the new person subscription launches可能已有人在做 @maebeale 于 79 天前认领。 未关闭blocked
难度 2/5 1-3 小时 新手友好度 72/100
rubyforgood/awbw#2095 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 84/100
rubyforgood/awbw#2088 ·
维护者通常 1 天内回复
相似的 Issue
-
verified
难度 2/5 1-3 小时 新手友好度 67/100
维护者通常 5 天内回复
-
难度 1/5 1 小时以内 新手友好度 86/100
akitaonrails/ai-book-2026#10 ·
-
难度 2/5 1-3 小时 新手友好度 68/100
TheOdinProject/curriculum#31495 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 76/100
zerocracy/judges-action#2984 ·
维护者通常 1 天内回复