Optional API rate limiter introduced

[tkardos]

No description provided.

[jbetala7]

The four failing specs are currently exercising the disabled path. rack_attack.rb reads PRIMERO_API_RATE_LIMIT_ENABLED, while the new spec's environment_variables list and enable_rate_limit helper use PRIMERO_RATE_LIMIT_ENABLED. The checked variable is never set, so the requests remain 200 instead of 429. Renaming those two test references to PRIMERO_API_RATE_LIMIT_ENABLED and rerunning bundle exec rspec spec/requests/api/v2/tokens_controller_spec.rb should exercise the limiter.

[pnabutovsky]

This particular order can be spoofed. A crafted request may set both a valid session cookie and a bogus authorization header. For that matter an attack can simply rotate invalid session and auth credentials, thereby bypassing rackattack. In this scenario I would only trust the underlying IP address request.remote_ip that comes from TCP/IP and is thus harder to mess with. Can you get rid of authorization and session?

[tkardos]

Good point, now it's only IP based.

[pnabutovsky]

For future reference, we maintain non-English translations for application strings in Transifex. I'll add this particular one manually, but you can review the Hungarian ones here: https://app.transifex.com/primero-v2/primero-app-v2/language/hu/

[tkardos]

Thanks for helping out on this one

[pnabutovsky]

Can you move this new code to a separate new file spec/middleware/rack_attack_spec.rb?

[tkardos]

I moved it to a new file as advised.

[pnabutovsky]

Good stuff