rack/rack-attack

Health v2 · maintenance only

Adoption not part of the score

5763 stars · 345 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Rack::Attack is Rack middleware for protecting Ruby and Rails web applications from abusive clients. It lets you define rules to allow, blocklist, safelist, and throttle requests based on request properties.

Use cases

• throttle requests per IP in a Rails app
• block abusive clients from my API
• rate limit login endpoints to prevent brute force
• safelist office IPs while blocking others
• ban IPs after repeated failed requests with fail2ban-style rules
• add RateLimit headers to API responses

When to choose

• you run a Rack-based app (Rails, Sinatra) and need request throttling or blocking
• you want simple, configurable middleware-level abuse protection without extra infrastructure
• you need fail2ban/allow2ban-style dynamic banning at the app layer

When to avoid

• you need network-level or edge protection (use a WAF, CDN, or load balancer instead)
• your app is not Ruby/Rack-based
• you need distributed rate limiting across many datacenters with strict guarantees beyond a shared cache store

Facets

library · maturity stable

middleware rate-limiting security web-framework security web-development backend ruby self-hosted rack rails throttling blocklist safelist abuse-protection rate-limiting web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="rack/rack-attack")