|
1 | 1 | module RackAttackExamples |
2 | | - shared_examples "throttles traffic from a single IP address" do |routes:, limit:, period:| |
| 2 | + RSpec.shared_context "with rack attack helpers" do |
| 3 | + def process_request(method, path, headers) |
| 4 | + process(method.to_sym, public_send(path, **route_params), headers: headers) |
| 5 | + end |
| 6 | + |
| 7 | + def expect_throttled_response(method, path, headers) |
| 8 | + process_request(method, path, headers) |
| 9 | + expect(response).to have_http_status(:too_many_requests) |
| 10 | + end |
| 11 | + |
| 12 | + def expect_not_throttled_response(method, path, headers) |
| 13 | + process_request(method, path, headers) |
| 14 | + expect(response).not_to have_http_status(:too_many_requests) |
| 15 | + end |
| 16 | + end |
| 17 | + |
| 18 | + RSpec.shared_examples "throttles traffic from a single IP address" do |routes:, limit:, period:| |
| 19 | + include_context "with rack attack helpers" |
3 | 20 | let(:route_params) { {} } |
4 | 21 |
|
5 | 22 | routes.each do |path, methods| |
6 | 23 | methods.each do |method| |
7 | | - context "when a single IP address uses it's allowance of traffic to #{method} #{path}", :rack_attack do |
8 | | - let(:ip_address) { "1.2.3.4" } |
| 24 | + context "when a single IP address uses its allowance of traffic to #{method} #{path}", :rack_attack do |
| 25 | + let(:headers) { { "HTTP_TRUE_CLIENT_IP" => "1.2.3.4" } } |
9 | 26 |
|
10 | 27 | before do |
11 | 28 | limit.times do |i| |
12 | | - process(method.to_sym, |
13 | | - public_send(path, **route_params), |
14 | | - headers: { "HTTP_TRUE_CLIENT_IP": ip_address }) |
| 29 | + process_request(method, path, headers) |
15 | 30 | raise "Returning too_many_requests on request #{i + 1}" if response.status == 429 |
16 | 31 | end |
17 | 32 | end |
18 | 33 |
|
19 | 34 | it "rejects the next request from that IP address" do |
20 | | - process(method.to_sym, |
21 | | - public_send(path, **route_params), |
22 | | - headers: { "HTTP_TRUE_CLIENT_IP": ip_address }) |
23 | | - |
24 | | - expect(response).to have_http_status(:too_many_requests) |
| 35 | + expect_throttled_response(method, path, headers) |
25 | 36 | end |
26 | 37 |
|
27 | 38 | it "doesn't reject a request from a different IP address" do |
28 | | - process(method.to_sym, |
29 | | - public_send(path, **route_params), |
30 | | - headers: { "HTTP_TRUE_CLIENT_IP": "4.5.6.7" }) |
31 | | - |
32 | | - expect(response).not_to have_http_status(:too_many_requests) |
| 39 | + expect_not_throttled_response(method, path, { "HTTP_TRUE_CLIENT_IP" => "4.5.6.7" }) |
33 | 40 | end |
34 | 41 |
|
35 | 42 | it "doesn't reject a request after the time period" do |
36 | 43 | travel_to(Time.current + period + 1.second) do |
37 | | - process(method.to_sym, |
38 | | - public_send(path, **route_params), |
39 | | - headers: { "HTTP_TRUE_CLIENT_IP": ip_address }) |
| 44 | + expect_not_throttled_response(method, path, headers) |
| 45 | + end |
| 46 | + end |
| 47 | + end |
| 48 | + end |
| 49 | + end |
| 50 | + end |
| 51 | + |
| 52 | + shared_examples "throttles traffic for an access token" do |routes:, period:| |
| 53 | + include_context "with rack attack helpers" |
| 54 | + let(:route_params) { {} } |
| 55 | + let(:headers) { { "HTTP_AUTHORIZATION" => "Bearer testtoken123" } } |
| 56 | + |
| 57 | + before do |
| 58 | + read_throttle = Rack::Attack.throttles["read requests to Conversations API with token"] |
| 59 | + allow(read_throttle).to receive(:limit).and_return(1) |
| 60 | + write_throttle = Rack::Attack.throttles["write requests to Conversations API with token"] |
| 61 | + allow(write_throttle).to receive(:limit).and_return(1) |
| 62 | + end |
| 63 | + |
| 64 | + routes.each do |path, methods| |
| 65 | + methods.each do |method| |
| 66 | + context "when an access token exhausts its allowance", :rack_attack do |
| 67 | + before { process_request(method, path, headers) } |
| 68 | + |
| 69 | + it "rejects the next request to #{method} #{path} using the same token" do |
| 70 | + expect_throttled_response(method, path, headers) |
| 71 | + end |
| 72 | + |
| 73 | + it "normalises Bearer tokens with different formats" do |
| 74 | + [ |
| 75 | + "bearer testtoken123", |
| 76 | + "BEARER testtoken123", |
| 77 | + " Bearer testtoken123", |
| 78 | + "Bearer testtoken123 ", |
| 79 | + ].each do |auth_value| |
| 80 | + process_request(method, path, { "HTTP_AUTHORIZATION" => auth_value }) |
| 81 | + expect(response).to have_http_status(:too_many_requests) |
| 82 | + end |
| 83 | + end |
| 84 | + |
| 85 | + it "doesn't reject a request to #{method} #{path} using a different token" do |
| 86 | + expect_not_throttled_response( |
| 87 | + method, |
| 88 | + path, |
| 89 | + { "HTTP_AUTHORIZATION" => "Bearer testtoken456" }, |
| 90 | + ) |
| 91 | + end |
| 92 | + |
| 93 | + it "doesn't reject a request to #{method} #{path} after the time period" do |
| 94 | + travel_to(Time.current + period + 1.second) do |
| 95 | + expect_not_throttled_response(method, path, headers) |
| 96 | + end |
| 97 | + end |
| 98 | + end |
| 99 | + end |
| 100 | + end |
| 101 | + end |
40 | 102 |
|
41 | | - expect(response).not_to have_http_status(:too_many_requests) |
| 103 | + RSpec.shared_examples "throttles traffic for a single device" do |routes:, period:| |
| 104 | + include_context "with rack attack helpers" |
| 105 | + let(:route_params) { {} } |
| 106 | + let(:headers) { { "HTTP_GOVUK_CHAT_CLIENT_DEVICE_ID" => "test-device-123" } } |
| 107 | + |
| 108 | + before do |
| 109 | + read_throttle = Rack::Attack.throttles["read requests to Conversations API with device id"] |
| 110 | + allow(read_throttle).to receive(:limit).and_return(1) |
| 111 | + |
| 112 | + write_throttle = Rack::Attack.throttles["write requests to Conversations API with device id"] |
| 113 | + allow(write_throttle).to receive(:limit).and_return(1) |
| 114 | + end |
| 115 | + |
| 116 | + routes.each do |path, methods| |
| 117 | + methods.each do |method| |
| 118 | + context "when a user's device uses its allowance", :rack_attack do |
| 119 | + before { process_request(method, path, headers) } |
| 120 | + |
| 121 | + it "rejects the next request to #{method} #{path} with the same device ID" do |
| 122 | + expect_throttled_response(method, path, headers) |
| 123 | + end |
| 124 | + |
| 125 | + it "doesn't reject a request to #{method} #{path} with a different device ID" do |
| 126 | + expect_not_throttled_response( |
| 127 | + method, |
| 128 | + path, |
| 129 | + { "HTTP_GOVUK_CHAT_CLIENT_DEVICE_ID" => "test-device-456" }, |
| 130 | + ) |
| 131 | + end |
| 132 | + |
| 133 | + it "doesn't reject a request to #{method} #{path} after the time period" do |
| 134 | + travel_to(Time.current + period + 1.second) do |
| 135 | + expect_not_throttled_response(method, path, headers) |
42 | 136 | end |
43 | 137 | end |
44 | 138 | end |
|
0 commit comments