Request Throttling/Rate Limiting for Requests to a Specific Route

[Ruan Labuschagne]

Hi, 

I Want to implement Rack::Attack on my webapp that uses Roda to throttle/rate limit requests to an api endpoint that i  have, I've looked into how to Implement RackAttack and by default uses either ActiveSupport or Redis as  a cache, I want to stay away from ActiveSupport, and would prefer to not introduce another tech to my stack by introducing redis. Is there a simple way to throttle requests in roda that i am missing, or will i have to either write my own cache app/ introduce redis to my tech stack. 

Thank you for taking the time to look at my query. I appreciate it. 

Regards. 

[Jeremy Evans]

On Tue, Mar 11, 2025 at 1:16 PM Ruan Labuschagne <ruan...@gmail.com> wrote:

I Want to implement Rack::Attack on my webapp that uses Roda to throttle/rate limit requests to an api endpoint that i  have, I've looked into how to Implement RackAttack and by default uses either ActiveSupport or Redis as  a cache, I want to stay away from ActiveSupport, and would prefer to not introduce another tech to my stack by introducing redis. Is there a simple way to throttle requests in roda that i am missing, or will i have to either write my own cache app/ introduce redis to my tech stack. 

Roda does not offer such a feature currently.  It's not something I want to include as part of Roda, because it generally requires external dependencies, and I would prefer to avoid those. Supporting an in-memory store is simple and does not require dependencies, but likely users would not want that in production.

I definitely understand wanting to avoid ActiveSupport and wanting to avoid introducing new tech just for rack-attack. What would you prefer to use as the cache for rack-attack? 

Jeremy

[Ruan Labuschagne]

Currently Pstore is used in some places as temporary storage, I think I'm just going to write a custom temp store class that has the required functionality that rack attack's cache needs. Even if i write my own middleware to throttle the requests, some form of caching will be needed, so might as well just work toward getting RackAttack to work