Rack::Attack VS bullet

The first line of defense should be to put rate-limiting on your login endpoints. rack-attack can help with that. I recommend to limit the login attempts to 5 per minute for a username and block the IP for 30 minutes. You should also limit the number of login attempts from the same IP address, but this needs to be adjusted to the application you are working on, because if it is a tool used in classrooms, it might be legit to have 50 logins within a few minutes from the same IP. (I have a few post written about rack-attack)

Rack::Attack

Rack middleware for blocking & throttling abusive requests. Protect your Rails and Rack apps from bad clients. Rack::Attack lets you quickly decide when to allow, block, and throttle based on the properties of the request. Using this gem you can save your web application from attacks, we can whitelist IPs, Block requests according to requirements, and many more… Install Rack-attack gem: # In your Gemfile gem 'rack-attack' Enter fullscreen mode Exit fullscreen mode Plugging into the application Then tell your ruby web application to use rack-attack as a middleware. # config/application.rb # rack attack middleware config.middleware.use Rack::Attack Enter fullscreen mode Exit fullscreen mode Once you’ve done that, you’ll need to configure it. You can do this by creating the file, config/initializers/rack-attack.rband adding the rules to fit your needs. You can disable it permanently (like for a specific environment) or temporarily (can be helpful for specific test cases) by writing: Usage Safe listing Safelists have the most precedence, so any request matching a safelist would be allowed despite matching any number of blocklists or throttles. safelist_ip(ip_address_string) Rack::Attack.safelist_ip(“5.6.7.8”) Enter fullscreen mode Exit fullscreen mode safelist_ip(ip_subnet_string) Rack::Attack.safelist_ip(“5.6.7.0/24”) Enter fullscreen mode Exit fullscreen mode safelist(name, &block) Name your custom safelist and make your ruby-block argument return a truthy value if you want the request to be allowed, and false otherwise. Blocking blocklist_ip(ip_address_string) Rack::Attack.blocklist_ip(“1.2.3.4”) Enter fullscreen mode Exit fullscreen mode blocklist_ip(ip_subnet_string) Rack::Attack.blocklist_ip(“1.2.0.0/16”) Enter fullscreen mode Exit fullscreen mode blocklist(name, &block) Name your custom blocklist and make your ruby-block argument return a truthy value if you want the request to be blocked, and false otherwise. Throttling *throttle(name, options, &block) *( provide limit and period as options) Throttle state is stored in a configurable cache (which defaults to Rails.cache if present). Name your custom throttle, provide limit and period as options, and make your ruby-block argument return the discriminator. This discriminator is how you tell rack-attack whether you’re limiting per IP address, per user email, or any other. For example, if we want to restrict requests other than defined routes and display a custom error page. Error page: If we want to restrict requests/IP and if the request limit increases then send a reminder mail. For Example, we want to allow only 300 requests per 30 seconds after that will restrict requests from this IP till the next 30 seconds interval starting. Get error mail if the limit is extended. Performance The overhead of running Rack::Attack is typically negligible (a few milliseconds per request), but it depends on how many checks you’ve configured, and how long they take. Throttles usually require a network roundtrip to your cache server(s), so try to keep the number of throttle checks per request low. If a request is blocklisted or throttled, the response is a very simple Rack response. A single typical ruby web server thread can block several hundred requests per second. Sample rack-attack.rb file For more information: https://github.com/rack/rack-attack If this guide has been helpful to you and your team please share it with others!

Second vote for rack-attack!

You could use something like Rack Attack to mitigate this type of behavior if it becomes an issue.

The final gem I like to include in all projects is rack-attack. This is a rate limiting tool which is great for throttling dangerous actions in your app to prevent bot attacks or other malicious users.

rack-attack to prevent bruteforce and DDoS attacks

Check out Rack Attack. It lets you block bots that make requests too fast to be real users, or that request obviously-suspect URLs (/phpmyadmin for example). There are lots of other options, but those are the quick wins IMO.

Rails has Bullet[0] to help identify and warn you against N+1

Does Django have anything active? Quick search revealed nplusone[1] but its been dead since 2018.

[0] https://github.com/flyerhzm/bullet

[1] https://github.com/jmcarp/nplusone

Without seeing more of the app, it's tough to say for certain, but one gem you might find helpful is the [bullet](https://github.com/flyerhzm/bullet) gem -- set this up in the app then start browsing around the app in development. If you have any N+1 queries or other minor optimizations that could be done it will inform you about them.

Getting rid of N+1 queries - This can help improve the speed of an app. The Bullet or Prosopite gems can give a lending hand here. The N+1 Dilemma — Bullet or Prosopite? entails a brief comparison of both.

There's a Ruby gem called Bullet that identifies and warns developers about N+1 problems. You can also have it fail tests if detected.

I don't know if the approach is possible with every ORM or if it's just leveraging some Ruby perks, but I can't think of a good reason why you wouldn't use the equivalent everywhere.

https://github.com/flyerhzm/bullet

You might consider adding the bullet gem as a development requirement and see what it tells you, it's generally pretty good at spotting n-queries and letting you know how to fix them.

As a Rails developer, recently I found Bullet [0] which helps massively in dealing with eager loading. For some reason I expected the framework to manage this sort of thing for me, even when Rails actually does a ton out of the box already. Only while refactoring I picked up on queries dragging performance. Oh well...

[0] https://github.com/flyerhzm/bullet

This is good advice, it'll likely pick out some glaring issues right away. I would generally recommend looking at DB queries here too and recommend Bullet, but most software like DataDog, AppSignal etc will often also point N+1 and issues like it out.

In order to find all those N + 1 queries that are slowing down in your application, the community recommends using the Bullet gem.