Heroku 上的 REST 请求速率限制
为了避免滥用，我想在 Rails 应用程序中的 REST API 中添加速率限制。经过一些研究后，看起来最佳实践是 将此责任移至 Web 服务器，而不是在应用程序本身中检查这一点。不幸的是，这在我的情况下无法完成，因为我在 Heroku 上托管应用程序，因此无法控制网络服务器设置。
在这种情况下应该采取什么措施来阻止 API 的滥用？
To avoid abuse I'd like to add rate limiting to the REST API in our Rails application. After doing a bit of research into this it looks like the best practice is to move this responsibility into the web server rather than checking for this in the application itself. Unfortunately this can't be done in my case as I'm hosting the application on Heroku and so have no control over the web server set up.
What should be done in this case to stop abuse of the API?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我认为您正在寻找的是
rack-throttle或rack-attackgem。它们都允许限制，并且rack-attackgem 还允许您让人们超时一段时间，并阻止某些 IP 地址（如果他们多次违规或出于您想要的任何其他原因）阻止请求者。I think what you are looking for is the
rack-throttleorrack-attackgem. Both of them allow throttling and therack-attackgem also allows you to time people out for a certain period of time and block certain IP addresses if they are multiple time offenders or for whatever other reason you would want to block requesters.考虑在客户端上放置一个 cookie，或者更好的是，在用户帐户上放置一个字段，记录他们上次发出请求的时间（许多身份验证插件已经这样做），并且如果请求比以下时间更新，则简单地拒绝/延迟他们的请求，5 秒前（20 个请求/秒）。
注意：如果使用单线程 Web 服务器（例如 Mongrel），放置显式延迟而不是拒绝可能会延迟该 Mongrel 上的其他待处理请求。换句话说，它将影响您的其他用户。如果合适的话，可能会有一个小的 javascript/ajax 响应来通知用户他们的速率受到限制。想一想 StackOverflow 如何防止您在网站上过于频繁地执行某些操作。
Consider putting a cookie on the client, or better yet, a field on the user account that records the last time they made a request (many authentication plugins do this already), and simply reject/delay their request if it's more recent than, say, 5 seconds ago (20 requests/second).
NOTE: If using a single-threaded web server (e.g. Mongrel) putting in an explicit delay rather than a rejection might delay other pending request on that Mongrel. In other words, it's going to impact your other users. Maybe a small javascript/ajax response to notify the user that they are being rate limited, if that is appropriate. Think how StackOverflow prevents you from doing certain things too often on the site.