Rails 4重复HTTP POST请求垃圾邮件

Question

I have been working on a ruby on rails 4 application. For the most part the site is done, however I found a "security flaw" which allows me to capture the HTTP POST request via an intercepting proxy tool (Burp Suite). I can then send this POST request to a repeater, and re-submit the request over and over again. This effectively can be used to abuse my application and spam people. Before I go to launch this product, I need to fix this issue. This is where I need help. I would really like to avoid the usage of CAPTCHA, and I would like to keep the user-flow of the application as seamless as possible. So what are some good ways to prevent HTTP POST request spamming??

Thank you

Answer 1

The rack-attack gem allow you to block or throttle requests based on pretty much anything in the rack environment.

A classic example is to throttle the number of login attempts for a username, which you could do with

Rack::Attack.throttle('logins/email', :limit => 6, :period => 60.seconds) do |req|
  req.params['email']} if req.path == '/login' && req.post?
end

You can define as many of these throttles as you like (within reason obviously)