ruby 32 lines · 1 tab

Rate limiting with Redis and Rack::Attack

Alex Kumar Jan 2026

1 tab

class Rack::Attack
  Rack::Attack.cache.store = ActiveSupport::Cache::RedisCacheStore.new(url: ENV['REDIS_URL'])

  safelist('allow-localhost') do |req|
    req.ip == '127.0.0.1' || req.ip == '::1'
  end

  throttle('api/v1/auth', limit: 5, period: 1.minute) do |req|
    req.ip if req.path.start_with?('/api/v1/auth') && req.post?
  end

  throttle('api/v1/authenticated', limit: 300, period: 5.minutes) do |req|
    if req.path.start_with?('/api/v1') && req.env['HTTP_AUTHORIZATION'].present?
      token = req.env['HTTP_AUTHORIZATION'].split(' ').last
      payload = JwtService.decode(token)
      payload['user_id'] if payload
    end
  end

  throttle('api/v1/anonymous', limit: 60, period: 5.minutes) do |req|
    req.ip if req.path.start_with?('/api/v1') && req.env['HTTP_AUTHORIZATION'].blank?
  end

  self.throttled_response = ->(env) {
    retry_after = (env['rack.attack.match_data'] || {})[:period]
    [
      429,
      { 'Content-Type' => 'application/json', 'Retry-After' => retry_after.to_s },
      [{ error: 'RATE_LIMIT_EXCEEDED', retry_after: retry_after }.to_json]
    ]
  }
end

1 file · ruby Explain with highlit

Rate limiting is essential protection against abuse and ensures fair resource distribution across API consumers. Rack::Attack with Redis backing provides a robust, shared state solution that works across multiple application servers. I define different throttle rules for authenticated vs anonymous users, with more generous limits for known clients. The key is to return proper 429 Too Many Requests responses with Retry-After headers so well-behaved clients can back off gracefully. I also configure safelist rules for internal services and admin IPs. For production systems, I monitor throttle hits via metrics to distinguish between legitimate traffic spikes and actual attacks, which informs capacity planning decisions.

Related snips

ruby

class CommentsController < ApplicationController
  before_action :set_post

  def create
    @comment = @post.comments.build(comment_params)

System test: asserting Turbo Stream responses

rails hotwire turbo

by codesnips 4 tabs

ruby

class Post < ApplicationRecord
  belongs_to :author, class_name: 'User'
  has_many :comments, dependent: :destroy

  scope :published, -> { where.not(published_at: nil).where('published_at <= ?', Time.current) }
  scope :draft, -> { where(published_at: nil) }

ActiveRecord scopes for reusable query logic

rails activerecord patterns

by Alex Kumar 1 tab

ruby

payload = {
  sub: user.id,
  iss: 'https://auth.example.com',
  aud: 'codesnips-api',
  exp: 15.minutes.from_now.to_i,
  iat: Time.now.to_i,

JWT issuance and verification without common footguns

jwt authentication api

by Kai Nakamura 2 tabs

ruby

module Api
  module V1
    class UsersController < BaseController
      def show
        user = User.includes(:profile).find(params[:id])

ETags for conditional requests and caching

rails caching http-caching

by Alex Kumar 1 tab

ruby

class PostsController < ApplicationController
  def index
    @posts = Post.includes(:author)
                 .order(created_at: :desc)
                 .page(params[:page])
                 .per(10)

Turbo Frames: infinite scroll with lazy-loading frame

rails turbo hotwire

by codesnips 4 tabs

ruby

require "csv"

class PeopleCsvStream
  include Enumerable

  HEADERS = %w[id full_name email signed_up_at plan].freeze

Resilient CSV Export as a Streamed Response

rails performance streaming

by codesnips 3 tabs

Share this code

Here's the card — post it anywhere.

Rate limiting with Redis and Rack::Attack — share card

Link copied