LeadMagnet/leadchat
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

chore: Ability to disable rack attack on widget endpoints (#7729)

Browse Source
This commit is contained in:
Sojan Jose
2023-08-15 17:44:25 -07:00
committed by GitHub
parent 7b68a7639f
commit 2df83276e0
1 changed files with 17 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
config/initializers/rack_attack.rb
View File

@@ -105,6 +105,10 @@ class Rack::Attack
###-----------Widget API Throttling---------------### ###-----------Widget API Throttling---------------###
###-----------------------------------------------### ###-----------------------------------------------###
# Rack attack on widget APIs can be disabled by setting ENABLE_RACK_ATTACK_WIDGET_API to false
# For clients using the widgets in specific conditions like inside and iframe
# TODO: Deprecate this feature in future after finding a better solution
if ActiveModel::Type::Boolean.new.cast(ENV.fetch('ENABLE_RACK_ATTACK_WIDGET_API', true))
## Prevent Conversation Bombing on Widget APIs ### ## Prevent Conversation Bombing on Widget APIs ###
throttle('api/v1/widget/conversations', limit: 6, period: 12.hours) do |req| throttle('api/v1/widget/conversations', limit: 6, period: 12.hours) do |req|
req.ip if req.path_without_extentions == '/api/v1/widget/conversations' && req.post? req.ip if req.path_without_extentions == '/api/v1/widget/conversations' && req.post?
@@ -119,6 +123,7 @@ class Rack::Attack
throttle('widget?website_token={website_token}&cw_conversation={x-auth-token}', limit: 5, period: 1.hour) do |req| throttle('widget?website_token={website_token}&cw_conversation={x-auth-token}', limit: 5, period: 1.hour) do |req|
req.ip if req.path_without_extentions == '/widget' && ActionDispatch::Request.new(req.env).params['cw_conversation'].blank? req.ip if req.path_without_extentions == '/widget' && ActionDispatch::Request.new(req.env).params['cw_conversation'].blank?
end end
end
##-----------------------------------------------## ##-----------------------------------------------##
@@ -127,7 +132,7 @@ class Rack::Attack
###-----------------------------------------------### ###-----------------------------------------------###
## Prevent Abuse of Converstion Transcript APIs ### ## Prevent Abuse of Converstion Transcript APIs ###
throttle('/api/v1/accounts/:account_id/conversations/:conversation_id/transcript', limit: 20, period: 1.hour) do |req| throttle('/api/v1/accounts/:account_id/conversations/:conversation_id/transcript', limit: 30, period: 1.hour) do |req|
match_data = %r{/api/v1/accounts/(?<account_id>\d+)/conversations/(?<conversation_id>\d+)/transcript}.match(req.path) match_data = %r{/api/v1/accounts/(?<account_id>\d+)/conversations/(?<conversation_id>\d+)/transcript}.match(req.path)
match_data[:account_id] if match_data.present? match_data[:account_id] if match_data.present?
end end