search

fragmenta / fragmenta-cms

A user-friendly CMS written in Go (golang)
http://fragmenta.eu
MIT License
586 stars 70 forks source link

Add rate limiting on IP #6

Open kennygrant opened 8 years ago

kennygrant commented 8 years ago

Add rate limiting with IP as a filter. Possibly allow config of max tries per IP, and timeout between sets of tries, either in config file or in the code for the middleware (to avoid bloating the config with too many options).

pankajagarwal commented 7 years ago

Shouldn't this be handled at nginx or haproxy or LB level. one level above the real application. I mean this might be a thing you wouldn't want in a large deployment handling heavy traffic where the requests to the app server will come from load balancers.

kennygrant commented 7 years ago

It would definitely be optional, and in larger apps you're right it would be at a higher level, but might be useful in smaller apps to have this ability to avoid naive DOS attacks.

My end goal here is to have an application that is one binary and can be deployed anywhere with zero dependencies, but which you can scale out with a database/load balancer etc separately if required. So this isn't really a high priority item, just a note for later.