pax_global_header00006660000000000000000000000064137071011470014513gustar00rootroot0000000000000052 comment=cc1c3d707a53c4a3035fa7323bceabda125fa68c django-ratelimit-3.0.1/000077500000000000000000000000001370710114700147465ustar00rootroot00000000000000django-ratelimit-3.0.1/.gitignore000066400000000000000000000000661370710114700167400ustar00rootroot00000000000000*.pyc *.swp dist build *.egg-info docs/_build/* .tox/ django-ratelimit-3.0.1/.travis.yml000066400000000000000000000022621370710114700170610ustar00rootroot00000000000000dist: xenial language: python sudo: false env: - DJANGO_VERSION=1.11 - DJANGO_VERSION=2.0 - DJANGO_VERSION=2.1 - DJANGO_VERSION=2.2 - DJANGO_VERSION=3.0 - DJANGO_VERSION=master python: - "3.4" - "3.5" - "3.6" - "3.7" - "3.8" - "pypy3.5" install: - if [[ $DJANGO_VERSION != master ]]; then pip install --pre -q "Django>=${DJANGO_VERSION},<${DJANGO_VERSION}.99"; fi - if [[ $DJANGO_VERSION == master ]]; then pip install https://github.com/django/django/archive/master.tar.gz; fi - pip install django-redis flake8 python3-memcached script: - ./run.sh test - ./run.sh flake8 matrix: exclude: - python: "3.4" env: DJANGO_VERSION=2.1 - python: "3.4" env: DJANGO_VERSION=2.2 - python: "3.4" env: DJANGO_VERSION=3.0 - python: "3.4" env: DJANGO_VERSION=master - python: "3.5" env: DJANGO_VERSION=3.0 - python: "3.5" env: DJANGO_VERSION=master - python: "pypy3.5" env: DJANGO_VERSION=3.0 - python: "pypy3.5" env: DJANGO_VERSION=master allow_failures: - python: "3.6" env: DJANGO_VERSION=master - python: "3.7" env: DJANGO_VERSION=master - python: "3.8" env: DJANGO_VERSION=master django-ratelimit-3.0.1/CHANGELOG000066400000000000000000000053411370710114700161630ustar00rootroot00000000000000========== Change Log ========== 3.0.1 ===== Bug fixes --------- - Fix import path values for rate= argument (#206) 3.0 ==== Breaking changes: ----------------- - Drop Python 2 support (#167) - Drop Django < 2.1 support (#167, #198) - @ratelimit no longer directly supports class methods, use @method_decorator - Drop RatelimitMixin in favor of @method_decorator - Moved is_ratelimited to ratelimit.core from ratelimit.utils - Moved ratelimit.utils.get_usage_count to ratelimit.core.get_usage Additions: ---------- - Made ratelimit.core.get_usage a documented, public method. - Add IP address masking (#178) - Add "Recipes" section to documentation Minor changes: -------------- - Update RatelimitMiddleware to modern style (#168) - Refactor is_ratelimited and get_usage so is_ratelimited is a thinner wrapper v2.0.0 ====== - A number of docs fixes - Fail open when cache is unavailable - Drop support for Django 1.8, 1.9, and 1.10 - Fix Django 2.0 compatibility and update documentation - Test Django 2.1 support v1.1.0 ====== - Test against Django 1.11 and 2.0b - Fix #85, explicitly set cache expiration slightly longer than cache window. - Add Django version classifiers. v1.0.1 ====== - Added Django 1.10 support. v1.0.0 ====== - Allow requests through when cache backend is unavailable. - Add support for Django 1.9, drop support for Django <=1.7. - Fix several small documentation issues. - Fix support for missing headers. v0.6 ==== - Fix CBV inheritance. - Better Django 1.8 support, fixing deprecation warnings and testing. - Clean up some out-of-date docs. - Fix counting behavior around increment and new cache keys. - Correctly pass `group` to callable `key`s. v0.5 ==== - Rates are now counted in fixed—instead of sliding—windows, except for per-second limits. See the Upgrade Notes. - Mixin renamed to `RatelimitMixin` (lowercase `l`) for consistency. - Dramatic rewrite. - `ip`, `field`, and `keys` arguments replaced with `key`. - well-known "key" values support. - Custom callable rate functions. - Support for "not limited" rate. - Replaces ``skip_if`` argument. v0.4 ==== - (Sort of) make @ratelimit decorators stack. - Add RateLimitMixin for CBVs. - Fixes for Python <2.7. - Clean up Travis and tox tests. v0.3 ==== - Drop the 'Backend' concept. - Add settings: RATELIMIT_USE_CACHE and RATELIMIT_CACHE_PREFIX. - Allow custom key functions. - Tests with Django 1.4.x and 1.5.x. - Refactor to simplify tests and development requirements. v0.2 ==== - Added real docs. - Fix unicode field values. - Add real tests. - Use the Ratelimited exception, RatelimitMiddleware, and RATELIMIT_VIEW setting. - Add RATELIMIT_ENABLE setting. - Add the skip_if argument. - Always add request.limited. v0.1 ==== - Initial release. django-ratelimit-3.0.1/CONTRIBUTING.rst000066400000000000000000000011361370710114700174100ustar00rootroot00000000000000============ Contributing ============ For set up, tests, and code standards, see `the documentation`_. Client IP Address ================= Because this comes up frequently: I will not accept a pull request or issue attempting to handle client IP address when Django is behind a proxy. *Ratelimit is the wrong place for this.* There are more details in the `security chapter`_ of the documentation. .. _the documentation: https://django-ratelimit.readthedocs.org/en/latest/contributing.html .. _security chapter: https://django-ratelimit.readthedocs.org/en/latest/security.html#client-ip-address django-ratelimit-3.0.1/LICENSE000066400000000000000000000010551370710114700157540ustar00rootroot00000000000000Copyright (c) 2014, James Socol Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. django-ratelimit-3.0.1/MANIFEST.in000066400000000000000000000001111370710114700164750ustar00rootroot00000000000000include CHANGELOG include LICENSE include MANIFEST.in include README.rst django-ratelimit-3.0.1/README.rst000066400000000000000000000011071370710114700164340ustar00rootroot00000000000000================ Django Ratelimit ================ Django Ratelimit provides a decorator to rate-limit views. Limiting can be based on IP address or a field in the request--either a GET or POST variable. .. image:: https://travis-ci.org/jsocol/django-ratelimit.svg?branch=master :target: https://travis-ci.org/jsocol/django-ratelimit :Code: https://github.com/jsocol/django-ratelimit :License: Apache Software License 2.0; see LICENSE file :Issues: https://github.com/jsocol/django-ratelimit/issues :Documentation: http://django-ratelimit.readthedocs.io/ django-ratelimit-3.0.1/docs/000077500000000000000000000000001370710114700156765ustar00rootroot00000000000000django-ratelimit-3.0.1/docs/Makefile000066400000000000000000000127401370710114700173420ustar00rootroot00000000000000# Makefile for Sphinx documentation # # You can set these variables from the command line. SPHINXOPTS = SPHINXBUILD = sphinx-build PAPER = BUILDDIR = _build # Internal variables. PAPEROPT_a4 = -D latex_paper_size=a4 PAPEROPT_letter = -D latex_paper_size=letter ALLSPHINXOPTS = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) . # the i18n builder cannot share the environment and doctrees with the others I18NSPHINXOPTS = $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) . .PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest gettext help: @echo "Please use \`make ' where is one of" @echo " html to make standalone HTML files" @echo " dirhtml to make HTML files named index.html in directories" @echo " singlehtml to make a single large HTML file" @echo " pickle to make pickle files" @echo " json to make JSON files" @echo " htmlhelp to make HTML files and a HTML help project" @echo " qthelp to make HTML files and a qthelp project" @echo " devhelp to make HTML files and a Devhelp project" @echo " epub to make an epub" @echo " latex to make LaTeX files, you can set PAPER=a4 or PAPER=letter" @echo " latexpdf to make LaTeX files and run them through pdflatex" @echo " text to make text files" @echo " man to make manual pages" @echo " texinfo to make Texinfo files" @echo " info to make Texinfo files and run them through makeinfo" @echo " gettext to make PO message catalogs" @echo " changes to make an overview of all changed/added/deprecated items" @echo " linkcheck to check all external links for integrity" @echo " doctest to run all doctests embedded in the documentation (if enabled)" clean: -rm -rf $(BUILDDIR)/* html: $(SPHINXBUILD) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html @echo @echo "Build finished. The HTML pages are in $(BUILDDIR)/html." dirhtml: $(SPHINXBUILD) -b dirhtml $(ALLSPHINXOPTS) $(BUILDDIR)/dirhtml @echo @echo "Build finished. The HTML pages are in $(BUILDDIR)/dirhtml." singlehtml: $(SPHINXBUILD) -b singlehtml $(ALLSPHINXOPTS) $(BUILDDIR)/singlehtml @echo @echo "Build finished. The HTML page is in $(BUILDDIR)/singlehtml." pickle: $(SPHINXBUILD) -b pickle $(ALLSPHINXOPTS) $(BUILDDIR)/pickle @echo @echo "Build finished; now you can process the pickle files." json: $(SPHINXBUILD) -b json $(ALLSPHINXOPTS) $(BUILDDIR)/json @echo @echo "Build finished; now you can process the JSON files." htmlhelp: $(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) $(BUILDDIR)/htmlhelp @echo @echo "Build finished; now you can run HTML Help Workshop with the" \ ".hhp project file in $(BUILDDIR)/htmlhelp." qthelp: $(SPHINXBUILD) -b qthelp $(ALLSPHINXOPTS) $(BUILDDIR)/qthelp @echo @echo "Build finished; now you can run "qcollectiongenerator" with the" \ ".qhcp project file in $(BUILDDIR)/qthelp, like this:" @echo "# qcollectiongenerator $(BUILDDIR)/qthelp/DjangoRatelimit.qhcp" @echo "To view the help file:" @echo "# assistant -collectionFile $(BUILDDIR)/qthelp/DjangoRatelimit.qhc" devhelp: $(SPHINXBUILD) -b devhelp $(ALLSPHINXOPTS) $(BUILDDIR)/devhelp @echo @echo "Build finished." @echo "To view the help file:" @echo "# mkdir -p $$HOME/.local/share/devhelp/DjangoRatelimit" @echo "# ln -s $(BUILDDIR)/devhelp $$HOME/.local/share/devhelp/DjangoRatelimit" @echo "# devhelp" epub: $(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub @echo @echo "Build finished. The epub file is in $(BUILDDIR)/epub." latex: $(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex @echo @echo "Build finished; the LaTeX files are in $(BUILDDIR)/latex." @echo "Run \`make' in that directory to run these through (pdf)latex" \ "(use \`make latexpdf' here to do that automatically)." latexpdf: $(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex @echo "Running LaTeX files through pdflatex..." $(MAKE) -C $(BUILDDIR)/latex all-pdf @echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex." text: $(SPHINXBUILD) -b text $(ALLSPHINXOPTS) $(BUILDDIR)/text @echo @echo "Build finished. The text files are in $(BUILDDIR)/text." man: $(SPHINXBUILD) -b man $(ALLSPHINXOPTS) $(BUILDDIR)/man @echo @echo "Build finished. The manual pages are in $(BUILDDIR)/man." texinfo: $(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo @echo @echo "Build finished. The Texinfo files are in $(BUILDDIR)/texinfo." @echo "Run \`make' in that directory to run these through makeinfo" \ "(use \`make info' here to do that automatically)." info: $(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo @echo "Running Texinfo files through makeinfo..." make -C $(BUILDDIR)/texinfo info @echo "makeinfo finished; the Info files are in $(BUILDDIR)/texinfo." gettext: $(SPHINXBUILD) -b gettext $(I18NSPHINXOPTS) $(BUILDDIR)/locale @echo @echo "Build finished. The message catalogs are in $(BUILDDIR)/locale." changes: $(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) $(BUILDDIR)/changes @echo @echo "The overview file is in $(BUILDDIR)/changes." linkcheck: $(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck @echo @echo "Link check complete; look for any errors in the above output " \ "or in $(BUILDDIR)/linkcheck/output.txt." doctest: $(SPHINXBUILD) -b doctest $(ALLSPHINXOPTS) $(BUILDDIR)/doctest @echo "Testing of doctests in the sources finished, look at the " \ "results in $(BUILDDIR)/doctest/output.txt." django-ratelimit-3.0.1/docs/conf.py000066400000000000000000000172231370710114700172020ustar00rootroot00000000000000# -*- coding: utf-8 -*- # # Django Ratelimit documentation build configuration file, created by # sphinx-quickstart on Fri Jan 4 15:55:31 2013. # # This file is execfile()d with the current directory set to its containing dir. # # Note that not all possible configuration values are present in this # autogenerated file. # # All configuration values have a default; values that are commented out # serve to show the default. import sys, os # If extensions (or modules to document with autodoc) are in another directory, # add these directories to sys.path here. If the directory is relative to the # documentation root, use os.path.abspath to make it absolute, like shown here. #sys.path.insert(0, os.path.abspath('.')) # -- General configuration ----------------------------------------------------- # If your documentation needs a minimal Sphinx version, state it here. #needs_sphinx = '1.0' # Add any Sphinx extension module names here, as strings. They can be extensions # coming with Sphinx (named 'sphinx.ext.*') or your custom ones. extensions = [] # Add any paths that contain templates here, relative to this directory. templates_path = ['_templates'] # The suffix of source filenames. source_suffix = '.rst' # The encoding of source files. #source_encoding = 'utf-8-sig' # The master toctree document. master_doc = 'index' # General information about the project. project = u'Django Ratelimit' copyright = u'2020, James Socol' # The version info for the project you're documenting, acts as replacement for # |version| and |release|, also used in various other places throughout the # built documents. # # The short X.Y version. version = '3.0' # The full version, including alpha/beta/rc tags. release = '3.0.1' # The language for content autogenerated by Sphinx. Refer to documentation # for a list of supported languages. #language = None # There are two options for replacing |today|: either, you set today to some # non-false value, then it is used: #today = '' # Else, today_fmt is used as the format for a strftime call. #today_fmt = '%B %d, %Y' # List of patterns, relative to source directory, that match files and # directories to ignore when looking for source files. exclude_patterns = ['_build'] # The reST default role (used for this markup: `text`) to use for all documents. #default_role = None # If true, '()' will be appended to :func: etc. cross-reference text. #add_function_parentheses = True # If true, the current module name will be prepended to all description # unit titles (such as .. function::). #add_module_names = True # If true, sectionauthor and moduleauthor directives will be shown in the # output. They are ignored by default. #show_authors = False # The name of the Pygments (syntax highlighting) style to use. pygments_style = 'sphinx' highlight_language = 'python' # A list of ignored prefixes for module index sorting. #modindex_common_prefix = [] # -- Options for HTML output --------------------------------------------------- # The theme to use for HTML and HTML Help pages. See the documentation for # a list of builtin themes. html_theme = 'default' # Theme options are theme-specific and customize the look and feel of a theme # further. For a list of options available for each theme, see the # documentation. #html_theme_options = {} # Add any paths that contain custom themes here, relative to this directory. #html_theme_path = [] # The name for this set of Sphinx documents. If None, it defaults to # " v documentation". #html_title = None # A shorter title for the navigation bar. Default is the same as html_title. #html_short_title = None # The name of an image file (relative to this directory) to place at the top # of the sidebar. #html_logo = None # The name of an image file (within the static path) to use as favicon of the # docs. This file should be a Windows icon file (.ico) being 16x16 or 32x32 # pixels large. #html_favicon = None # Add any paths that contain custom static files (such as style sheets) here, # relative to this directory. They are copied after the builtin static files, # so a file named "default.css" will overwrite the builtin "default.css". #html_static_path = [] # If not '', a 'Last updated on:' timestamp is inserted at every page bottom, # using the given strftime format. #html_last_updated_fmt = '%b %d, %Y' # If true, SmartyPants will be used to convert quotes and dashes to # typographically correct entities. #html_use_smartypants = True # Custom sidebar templates, maps document names to template names. #html_sidebars = {} # Additional templates that should be rendered to pages, maps page names to # template names. #html_additional_pages = {} # If false, no module index is generated. #html_domain_indices = True # If false, no index is generated. #html_use_index = True # If true, the index is split into individual pages for each letter. #html_split_index = False # If true, links to the reST sources are added to the pages. #html_show_sourcelink = True # If true, "Created using Sphinx" is shown in the HTML footer. Default is True. #html_show_sphinx = True # If true, "(C) Copyright ..." is shown in the HTML footer. Default is True. #html_show_copyright = True # If true, an OpenSearch description file will be output, and all pages will # contain a tag referring to it. The value of this option must be the # base URL from which the finished HTML is served. #html_use_opensearch = '' # This is the file name suffix for HTML files (e.g. ".xhtml"). #html_file_suffix = None # Output file base name for HTML help builder. htmlhelp_basename = 'DjangoRatelimitdoc' # -- Options for LaTeX output -------------------------------------------------- latex_elements = { # The paper size ('letterpaper' or 'a4paper'). #'papersize': 'letterpaper', # The font size ('10pt', '11pt' or '12pt'). #'pointsize': '10pt', # Additional stuff for the LaTeX preamble. #'preamble': '', } # Grouping the document tree into LaTeX files. List of tuples # (source start file, target name, title, author, documentclass [howto/manual]). latex_documents = [ ('index', 'DjangoRatelimit.tex', u'Django Ratelimit Documentation', u'James Socol', 'manual'), ] # The name of an image file (relative to this directory) to place at the top of # the title page. #latex_logo = None # For "manual" documents, if this is true, then toplevel headings are parts, # not chapters. #latex_use_parts = False # If true, show page references after internal links. #latex_show_pagerefs = False # If true, show URL addresses after external links. #latex_show_urls = False # Documents to append as an appendix to all manuals. #latex_appendices = [] # If false, no module index is generated. #latex_domain_indices = True # -- Options for manual page output -------------------------------------------- # One entry per manual page. List of tuples # (source start file, name, description, authors, manual section). man_pages = [ ('index', 'djangoratelimit', u'Django Ratelimit Documentation', [u'James Socol'], 1) ] # If true, show URL addresses after external links. #man_show_urls = False # -- Options for Texinfo output ------------------------------------------------ # Grouping the document tree into Texinfo files. List of tuples # (source start file, target name, title, author, # dir menu entry, description, category) texinfo_documents = [ ('index', 'DjangoRatelimit', u'Django Ratelimit Documentation', u'James Socol', 'DjangoRatelimit', 'One line description of project.', 'Miscellaneous'), ] # Documents to append as an appendix to all manuals. #texinfo_appendices = [] # If false, no module index is generated. #texinfo_domain_indices = True # How to display URL addresses: 'footnote', 'no', or 'inline'. #texinfo_show_urls = 'footnote' django-ratelimit-3.0.1/docs/contributing.rst000066400000000000000000000015021370710114700211350ustar00rootroot00000000000000.. _contributing-chapter: ============ Contributing ============ Set Up ====== Create a virtualenv_ and install Django with pip_: .. code-block:: sh $ pip install Django Running the Tests ================= Running the tests is as easy as: .. code-block:: sh $ ./run.sh test You may also run the test on multiple versions of Django using tox. - First install tox: .. code-block:: sh $ pip install tox - Then run the tests with tox: .. code-block:: sh $ tox Code Standards ============== I ask two things for pull requests. * The flake8_ tool must not report any violations. * All tests, including new tests where appropriate, must pass. .. _virtualenv: http://www.virtualenv.org/en/latest/ .. _pip: http://www.pip-installer.org/en/latest/ .. _flake8: https://pypi.python.org/pypi/flake8 django-ratelimit-3.0.1/docs/cookbook/000077500000000000000000000000001370710114700175045ustar00rootroot00000000000000django-ratelimit-3.0.1/docs/cookbook/429.rst000066400000000000000000000077161370710114700205670ustar00rootroot00000000000000.. _recipe-429: ================================= Sending ``429 Too Many Requests`` ================================= `RFC 6585`_ introduced a status code specific to rate-limiting situations: `HTTP 429 Too Many Requests`_. Here's one way to send this status with Django Ratelimit. Create a custom error view ========================== First, create a view that returns the correct type of response (e.g. content-type, shape, information, etc) for your application. For example, a JSON API may return something like ``{"error": "ratelimited"}``, while other applications may return XML, HTML, etc, as needed. Or you may need to decide based on the type of request. Set the status code of the response to 429. .. code-block:: python # myapp/views.py def ratelimited_error(request, exception): # e.g. to return HTML return render(request, 'ratelimited.html', status=429) def ratelimited_error(request, exception): # or other types: return JsonResponse({'error': 'ratelimited'}, status=429) In your app's settings, install the ``RatelimitMiddleware`` :ref:`middleware ` toward the bottom of the list. You must define ``RATELIMIT_VIEW`` as a dotted-path to your error view: .. code-block:: python MIDDLEWARE = ( # ... toward the bottom ... 'ratelimit.middleware.RatelimitMiddleware', # ... ) RATELIMIT_VIEW = 'myapp.views.ratelimited_error' That's it! If you already have :ref:`the decorator ` installed, you're good to go. Otherwise, you'll need to install it in order to trigger the error view. Check the exception type in ``handler403`` ========================================== Alternatively, if you already have a ``handler403`` view defined, you can check the exception type and return a specific status code: .. code-block:: python from ratelimit.exceptions import Ratelimited def my_403_handler(request, exception): if isinstance(exception, Ratelimited): return render(request, '429.html', status=429) return render(request, '403.html', status=403) Context ======= **Why doesn't Django Ratelimit handle this itself?** There are a couple of main reasons. The first is that Django has no built-in concept of a ratelimit exception, but it does have ``PermissionDenied``. When a view throws a ``PermissionDenied`` exception, Django has built-in facilities for handling it as a client error (it returns an HTTP 403) instead of a server error (i.e. a 5xx status code). The ``Ratelimited`` exception extends ``PermissionDenied`` so that, if nothing else, there should already be a way to make sure the application is sending a 4xx status code—even if it's not the most-correct status code available. ``Ratelimited`` should not be treated as a server error because the server is working correctly. (NB: That also means that the typical "error"-level logging is not invoked.) There is no way to convince the built-in handler to send any status besides 403. Furthermore, it's impossible for Django Ratelimit to provide a default view that does a better job guessing at the appropriate response type than Django's built-in ``PermissionDenied`` view already does. We could include a default ``429.html`` template with as little information as Django's built-in ``403.html``, but it would only be slightly more correct. The correct response for your users will depend on your application. This means creating the right content-type (e.g. JSON, XML, HTML, etc) and content (whether it's an API error response or a human-readable one). Django Ratelimit can't guess that, so it's up to you to define. Finally, a small historical note. Django Ratelimit actually predates RFC 6585 by about a year. At the time, 403 was as common as any status for ratelimit situations. Others were creating custom statuses, like Twitter's ``420 Enhance Your Calm``. .. _RFC 6585: https://tools.ietf.org/html/rfc6585 .. _HTTP 429 Too Many Requests: https://tools.ietf.org/html/rfc6585#section-4 django-ratelimit-3.0.1/docs/cookbook/index.rst000066400000000000000000000007111370710114700213440ustar00rootroot00000000000000.. _cookbook: ======== Cookbook ======== This section includes suggestions for common patterns that don't make sense to include in the main library because they depend on too many specific about consuming applications. These solutions may be close to copy-pastable, but in generally they are more directional and are provided under the same license as all other code in this repository. Recipes ======= .. toctree:: :maxdepth: 1 429 per-user django-ratelimit-3.0.1/docs/cookbook/per-user.rst000066400000000000000000000035701370710114700220050ustar00rootroot00000000000000.. _recipe-per-user: =================== Per-User Ratelimits =================== One common business strategy includes adjusting rate limits for different types of users, or even different individual users for enterprise sales. With :ref:`callable rates ` it is possible to implement per-user or per-group rate limits. Here is one example of how to implement per-user rates. A ``Ratelimit`` model ===================== This example leverages the database to store per-user rate limits. Keep in mind the additional load this may place on your application's database—which may very well be the resource you intend to protect. Consider caching these types of queries. .. code-block:: python # myapp/models.py class Ratelimit(models.Model): group = models.CharField(db_index=True) user = models.ForeignKey(null=True) # One option for "default" rate = models.CharField() @classmethod def get(cls, group, user=None): # use cache if possible try: return cls.objects.get(group=group, user=user) except cls.DoesNotExist: return cls.objects.get(group=group, user=None) # myapp/ratelimits.py from myapp.models import Ratelimit def per_user(group, request): if request.user.is_authenticated: return Ratelimit.get(group, request.user) return Ratelimit.get(group) # myapp/views.py @login_required @ratelimit(group='search', key='user', rate='myapp.ratelimits.per_user') def search_view(request): # ... It would be important to consider how to handle defaults, cases where the rate is not defined in the database, or the group is new, etc. It would also be important to consider the performance impact of executing such a query as part of the rate limiting process and consider how to store this data. django-ratelimit-3.0.1/docs/index.rst000066400000000000000000000030141370710114700175350ustar00rootroot00000000000000================ Django Ratelimit ================ Project ======= **Django Ratelimit** is a ratelimiting decorator for Django views, storing rate data in the configured `Django cache backend `__. .. image:: https://travis-ci.org/jsocol/django-ratelimit.png?branch=master :target: https://travis-ci.org/jsocol/django-ratelimit :Code: https://github.com/jsocol/django-ratelimit :License: Apache Software License :Issues: https://github.com/jsocol/django-ratelimit/issues :Documentation: http://django-ratelimit.readthedocs.org/ Quickstart ========== Install: .. code-block:: shell $ pip install django-ratelimit Use as a decorator in ``views.py``: .. code-block:: python from ratelimit.decorators import ratelimit @ratelimit(key='ip') def myview(request): # ... @ratelimit(key='ip', rate='100/h') def secondview(request): # ... After activating django-ratelimit, you should ensure that your cache backend is setup to be both persistent and work across multiple deployment worker instances (for instance UWSGI workers). Read more in the Django docs on `caching `__. .. _PyPI: http://pypi.python.org/pypi/django-ratelimit Contents ======== .. toctree:: :maxdepth: 2 settings usage keys rates security upgrading contributing cookbook/index Indices and tables ================== * :ref:`genindex` * :ref:`modindex` * :ref:`search` django-ratelimit-3.0.1/docs/keys.rst000066400000000000000000000045721370710114700174130ustar00rootroot00000000000000.. _keys-chapter: ============== Ratelimit Keys ============== The ``key=`` argument to the decorator takes either a string or a callable. .. _keys-common: Common keys =========== The following string values for ``key=`` provide shortcuts to commonly used ratelimit keys: - ``'ip'`` - Use the request IP address (i.e. ``request.META['REMOTE_ADDR']``) .. note:: If you are using a reverse proxy, make sure this value is correct or use an appropriate ``header:`` value. See the :ref:`security ` notes. - ``'get:X'`` - Use the value of ``request.GET.get('X', '')``. - ``'post:X'`` - Use the value of ``request.POST.get('X', '')``. - ``'header:x-x'`` - Use the value of ``request.META.get('HTTP_X_X', '')``. .. note:: The value right of the colon will be translated to all-caps and any dashes will be replaced with underscores, e.g.: x-client-ip => X_CLIENT_IP. - ``'user'`` - Use an appropriate value from ``request.user``. Do not use with unauthenticated users. - ``'user_or_ip'`` - Use an appropriate value from ``request.user`` if the user is authenticated, otherwise use ``request.META['REMOTE_ADDR']`` (see the note above about reverse proxies). .. note:: Missing headers, GET, and POST values will all be treated as empty strings, and ratelimited in the same bucket. .. warning:: Using user-supplied data, like data from GET and POST or headers directly from the User-Agent can allow users to trivially opt out of ratelimiting. See the note in :ref:`the security chapter `. .. _keys-strings: String values ============= Other string values not from the list above will be treated as the dotted Python path to a callable. See :ref:`below ` for more on callables. .. _keys-callable: Callable values =============== .. versionadded:: 0.3 .. versionchanged:: 0.5 Added support for python path to callables. .. versionchanged:: 0.6 Callable was mistakenly only passed the ``request``, now also gets ``group`` as documented. If the value of ``key=`` is a callable, or the path to a callable, that callable will be called with two arguments, the :ref:`group ` and the ``request`` object. It should return a bytestring or unicode object, e.g.:: def my_key(group, request): return request.META['REMOTE_ADDR'] + request.user.username django-ratelimit-3.0.1/docs/rates.rst000066400000000000000000000031421370710114700175460ustar00rootroot00000000000000.. _rates-chapter: ===== Rates ===== .. _rates-simple: Simple rates ============ Simple rates are of the form ``X/u`` where ``X`` is a number of requests and ``u`` is a unit from this list: * ``s`` - second * ``m`` - minute * ``h`` - hour * ``d`` - day (For example, you can read ``5/s`` as "five per second.") .. note:: Setting a rate of 0 per any unit of time will disallow requests, e.g. ``0/s`` will prevent any requests to the endpoint. Rates may also be set to ``None``, which indicates "there is no limit." Usage will not be tracked. You may also specify a number of units, i.e.: ``X/Yu`` where ``Y`` is a number of units. If ``u`` is omitted, it is presumed to be seconds. So, the following are equivalent, and all mean "one hundred requests per five minutes": * ``100/5m`` * ``100/300s`` * ``100/300`` .. _rates-callable: Callables ========= .. versionadded:: 0.5 Rates can also be callables (or dotted paths to callables, which are assumed if there is a ``.`` in the value). Callables receive two values, the :ref:`group ` and the ``request`` object. They should return a simple rate string, or a tuple of integers ``(count, seconds)``. For example:: def my_rate(group, request): if request.user.is_authenticated: return '1000/m' return '100/m' Or equivalently:: def my_rate_tuples(group, request): if request.user.is_authenticated: return (1000, 60) return (100, 60) Callables can return ``0`` in the first place to disallow any requests (e.g.: ``0/s``, ``(0, 60)``). They can return ``None`` for "no ratelimit". django-ratelimit-3.0.1/docs/security.rst000066400000000000000000000125241370710114700203030ustar00rootroot00000000000000.. _security-chapter: ======================= Security considerations ======================= .. _security-client-ip: Client IP address ================= IP address is an extremely common rate limit :ref:`key `, so it is important to configure correctly, especially in the equally-common case where Django is behind a load balancer or other reverse proxy. Django-Ratelimit is **not** the correct place to handle reverse proxies and adjust the IP address, and patches dealing with it will not be accepted. There is `too much variation`_ in the wild to handle it safely. This is the same reason `Django dropped`_ ``SetRemoteAddrFromForwardedFor`` middleware in 1.1: no such "mechanism can be made reliable enough for general-purpose use" and it "may lead developers to assume that the value of ``REMOTE_ADDR`` is 'safe'." Risks ----- Mishandling client IP data creates an IP spoofing vector that allows attackers to circumvent IP ratelimiting entirely. Consider an attacker with the real IP address 3.3.3.3 that adds the following to a request:: X-Forwarded-For: 1.2.3.4 A misconfigured web server may pass the header value along, e.g.:: X-Forwarded-For: 3.3.3.3, 1.2.3.4 Alternatively, if the web server sends a different header, like ``X-Cluster-Client-IP`` or ``X-Real-IP``, and passes along the spoofed ``X-Forwarded-For`` header unchanged, a mistake in ratelimit or a misconfiguration in Django could read the spoofed header instead of the intended one. Remediation ----------- There are two options, configuring django-ratelimit or adding global middleware. Which makes sense depends on your setup. Middleware ^^^^^^^^^^ Writing a small middleware class to set ``REMOTE_ADDR`` to the actual client IP address is generally simple:: def reverse_proxy(get_response): def process_request(request): request.META['REMOTE_ADDR'] = # [...] return get_response(request) return process_request where ``# [...]`` depends on your environment. This middleware should be close to the top of the list:: MIDDLEWARE = ( 'path.to.reverse_proxy', # ... ) Then the ``@ratelimit`` decorator can be used with the ``ip`` key:: @ratelimit(key='ip', rate='10/s') Ratelimit keys ^^^^^^^^^^^^^^ Alternatively, if the client IP address is in a simple header (i.e. a header like ``X-Real-IP`` that *only* contains the client IP, unlike ``X-Forwarded-For`` which may contain intermediate proxies) you can use a ``header:`` key:: @ratelimit(key='header:x-real-ip', rate='10/s') .. _too much variation: http://en.wikipedia.org/wiki/Talk:X-Forwarded-For#Variations .. _Django dropped: https://docs.djangoproject.com/en/2.1/releases/1.1/#removed-setremoteaddrfromforwardedfor-middleware .. _security-brute-force: Brute force attacks =================== One of the key uses of ratelimiting is preventing brute force or dictionary attacks against login forms. These attacks generally take one of a few forms: - One IP address trying one username with many passwords. - Many IP addresses trying one username with many passwords. - One IP address trying many usernames with a few common passwords. - Many IP addresses trying many usernames with one or a few common passwords. .. note:: Unfortunately, the fourth case of many IPs trying many usernames can be difficult to distinguish from regular user behavior and requires additional signals, such as a consistent user agent or a common network prefix. Protecting against the single IP address cases is easy:: @ratelimit(key='ip') def login_view(request): pass Also limiting by username provides better protection:: @ratelimit(key='ip') @ratelimit(key='post:username') def login_view(request): pass **Using passwords as key values is not recommended.** Key values are never stored in a raw form, even as cache keys, but they are constructed with a fast hash function. Denial of Service ----------------- However, limiting based on field values may open a `denial of service`_ vector against your users, preventing them from logging in. For pages like login forms, consider implementing a soft blocking mechanism, such as requiring a captcha, rather than a hard block with a ``PermissionDenied`` error. Network Address Translation --------------------------- Depending on your profile of your users, you may have many users behind NAT (e.g. users in schools or in corporate networks). It is reasonable to set a higher limit on a per-IP limit than on a username or password limit. .. _denial of service: http://en.wikipedia.org/wiki/Denial-of-service_attack?oldformat=true .. _security-user-supplied: User-supplied Data ================== Using data from GET (``key='get:X'``) POST (``key='post:X'``) or headers (``key='header:x-x'``) that are provided directly by the browser or other client presents a risk. Unless there is some requirement of the attack that requires the client *not* change the value (for example, attempting to brute force a password requires that the username be consistent) clients can trivially change these values on every request. Headers that are provided by web servers or reverse proxies should be independently audited to ensure they cannot be affected by clients. The ``User-Agent`` header is especially dangerous, since bad actors can change it on every request, and many good actors may share the same value. django-ratelimit-3.0.1/docs/settings.rst000066400000000000000000000031271370710114700202730ustar00rootroot00000000000000.. _settings-chapter: ======== Settings ======== ``RATELIMIT_CACHE_PREFIX`` -------------------------- An optional cache prefix for ratelimit keys (in addition to the ``PREFIX`` value defined on the cache backend). Defaults to ``'rl:'``. ``RATELIMIT_ENABLE`` -------------------- Set to ``False`` to disable rate-limiting across the board. Defaults to ``True``. May be useful during tests with Django's |override_settings|_ testing tool, for example: .. code-block:: python from django.test import override_settings with override_settings(RATELIMIT_ENABLE=False): result = call_the_view() .. |override_settings| replace:: ``override_settings()`` .. _override_settings: https://docs.djangoproject.com/en/2.0/topics/testing/tools/#django.test.override_settings. ``RATELIMIT_USE_CACHE`` ----------------------- The name of the cache (from the ``CACHES`` dict) to use. Defaults to ``'default'``. ``RATELIMIT_VIEW`` ------------------ The string import path to a view to use when a request is ratelimited, in conjunction with ``RatelimitMiddleware``, e.g. ``'myapp.views.ratelimited'``. Has no default - you must set this to use ``RatelimitMiddleware``. ``RATELIMIT_FAIL_OPEN`` ----------------------- Whether to allow requests when the cache backend fails. Defaults to ``False``. ``RATELIMIT_IPV4_MASK`` ----------------------- IPv4 mask for IP-based rate limit. Defaults to ``32`` (which is no masking) ``RATELIMIT_IPV6_MASK`` ----------------------- IPv6 mask for IP-based rate limit. Defaults to ``64`` (which mask the last 64 bits). Typical end site IPv6 assignment are from /48 to /64. django-ratelimit-3.0.1/docs/upgrading.rst000066400000000000000000000200641370710114700204120ustar00rootroot00000000000000.. _upgrading-chapter: ============= Upgrade Notes ============= See also the `CHANGELOG <../CHANGELOG>`. .. _upgrading-3.0: From 2.0 to 3.0 =============== Quickly: - Ratelimit now supports Django >=1.11 and Python >=3.4. - ``@ratelimit`` no longer works directly on class methods, add ``@method_decorator``. - ``RatelimitMixin`` is gone, migrate to ``@method_decorator``. - Moved ``is_ratelimted`` method from ``ratelimit.utils`` to ``ratelimit.core``. ``@ratelimit`` decorator on class methods ----------------------------------------- In 3.0, the decorator has been simplified and must now be used with Django's excellent ``@method_decorator`` utility. Migrating should be relatively straight-forward: .. code-block:: python from django.views.generic import View from ratelimit.decorators import ratelimit class MyView(View): @ratelimit(key='ip', rate='1/m', method='GET') def get(self, request): pass changes to .. code-block:: python from django.utils.decorators import method_decorator from django.views.generic import View from ratelimit.decorators import ratelimit class MyView(View): @method_decorator(ratelimit(key='ip', rate='1/m', method='GET')) def get(self, request): pass ``RatelimitMixin`` ------------------ ``RatelimitMixin`` is a vestige of an older version of Ratelimit that did not support multiple rates per method. As such, it is significantly less powerful than the current ``@ratelimit`` decorator. To migrate to the decorator, use the ``@method_decorator`` from Django: .. code-block:: python class MyView(RatelimitMixin, View): ratelimit_key = 'ip' ratelimit_rate = '10/m' ratelimit_method = 'GET' def get(self, request): pass becomes .. code-block:: python class MyView(View): @method_decorator(ratelimit(key='ip', rate='10/m', method='GET')) def get(self, request): pass The major benefit is that it is now possible to apply multiple limits to the same method, as with :ref:`the decorator `_. .. _upgrading-0.5: From <=0.4 to 0.5 ================= Quickly: - Rate limits are now counted against fixed, instead of sliding, windows. - Rate limits are no longer shared between methods by default. - Change ``ip=True`` to ``key='ip'``. - Drop ``ip=False``. - A key must always be specified. If using without an explicit key, add ``key='ip'``. - Change ``fields='foo'`` to ``post:foo`` or ``get:foo``. - Change ``keys=callable`` to ``key=callable``. - Change ``skip_if`` to a callable ``rate=`` method (see :ref:`Rates `. - Change ``RateLimitMixin`` to ``RatelimitMixin`` (note the lowercase ``l``). - Change ``ratelimit_ip=True`` to ``ratelimit_key='ip'``. - Change ``ratelimit_fields='foo'`` to ``post:foo`` or ``get:foo``. - Change ``ratelimit_keys=callable`` to ``ratelimit_key=callable``. Fixed windows ------------- Before 0.5, rates were counted against a *sliding* window, so if the rate limit was ``1/m``, and three requests came in:: 1.2.3.4 [09/Sep/2014:12:25:03] ... 1.2.3.4 [09/Sep/2014:12:25:53] ... 1.2.3.4 [09/Sep/2014:12:25:59] ... Even though the third request came nearly two minutes after the first request, the second request moved the window. Good actors could easily get caught in this, even trying to implement reasonable back-offs. Starting in 0.5, windows are *fixed*, and staggered throughout a given period based on the key value, so the third request, above would not be rate limited (it's possible neither would the second one). .. warning:: That means that given a rate of ``X/u``, you may see up to ``2 * X`` requests in a short period of time. Make sure to set ``X`` accordingly if this is an issue. This change still limits bad actors while being far kinder to good actors. Staggering windows ^^^^^^^^^^^^^^^^^^ To avoid a situation where all limits expire at the top of the hour, windows are automatically staggered throughout their period based on the key value. So if, for example, two IP addresses are hitting hourly limits, instead of both of those limits expiring at 06:00:00, one might expire at 06:13:41 (and subsequently at 07:13:41, etc) and the other might expire at 06:48:13 (and 07:48:13, etc). Sharing rate limits ------------------- Before 0.5, rate limits were shared between methods based only on their keys. This was very confusing and unintuitive, and is far from the least-surprising_ thing. For example, given these three views:: @ratelimit(ip=True, field='username') def both(request): pass @ratelimit(ip=False, field='username') def field_only(request): pass @ratelimit(ip=True) def ip_only(request): pass The pair ``both`` and ``field_only`` shares one rate limit key based on all requests to either (and any other views) containing the same ``username`` key (in ``GET`` or ``POST``), regardless of IP address. The pair ``both`` and ``ip_only`` shares one rate limit key based on the client IP address, along with all other views. Thus, it's extremely difficult to determine exactly why a request is getting rate limited. In 0.5, methods never share rate limits by default. Instead, limits are based on a combination of the :ref:`group `, rate, key value, and HTTP methods *to which the decorator applies* (i.e. **not** the method of the request). This better supports common use cases and stacking decorators, and still allows decorators to be shared. For example, this implements an hourly rate limit with a per-minute burst rate limit:: @ratelimit(key='ip', rate='100/m') @ratelimit(key='ip', rate='1000/h') def myview(request): pass However, this view is limited *separately* from another view with the same keys and rates:: @ratelimit(key='ip', rate='100/m') @ratelimit(key='ip', rate='1000/h') def anotherview(request): pass To cause the views to share a limit, explicitly set the ``group`` argument:: @ratelimit(group='lists', key='user', rate='100/h') def user_list(request): pass @ratelimit(group='lists', key='user', rate='100/h') def group_list(request): pass You can also stack multiple decorators with different sets of applicable methods:: @ratelimit(key='ip', method='GET', rate='1000/h') @ratelimit(key='ip', method='POST', rate='100/h') def maybe_expensive(request): pass This allows a total of 1,100 requests to this view in one hour, while this would only allow 1000, but still only 100 POSTs:: @ratelimit(key='ip', method=['GET', 'POST'], rate='1000/h') @ratelimit(key='ip', method='POST', rate='100/h') def maybe_expensive(request): pass And these two decorators would not share a rate limit:: @ratelimit(key='ip', method=['GET', 'POST'], rate='100/h') def foo(request): pass @ratelimit(key='ip', method='GET', rate='100/h') def bar(request): pass But these two do share a rate limit:: @ratelimit(group='a', key='ip', method=['GET', 'POST'], rate='1/s') def foo(request): pass @ratelimit(group='a', key='ip', method=['POST', 'GET'], rate='1/s') def bar(request): pass Using multiple decorators ------------------------- A single ``@ratelimit`` decorator used to be able to ratelimit against multiple keys, e.g., before 0.5:: @ratelimit(ip=True, field='username', keys=mykeysfunc) def someview(request): # ... To simplify both the internals and the question of what limits apply, each decorator now tracks exactly one rate, but decorators can be more reliably stacked (c.f. some examples in the section above). The pre-0.5 example above would need to become four decorators:: @ratelimit(key='ip') @ratelimit(key='post:username') @ratelimit(key='get:username') @ratelimit(key=mykeysfunc) def someview(request): # ... As documented above, however, this allows powerful new uses, like burst limits and distinct GET/POST limits. .. _least-surprising: http://en.wikipedia.org/wiki/Principle_of_least_astonishment django-ratelimit-3.0.1/docs/usage.rst000066400000000000000000000237501370710114700175430ustar00rootroot00000000000000.. _usage-chapter: ====================== Using Django Ratelimit ====================== .. _usage-decorator: Use as a decorator ================== Import: .. code-block:: python from ratelimit.decorators import ratelimit .. py:decorator:: ratelimit(group=None, key=, rate=None, method=ALL, block=False) :arg group: *None* A group of rate limits to count together. Defaults to the dotted name of the view. :arg key: What key to use, see :ref:`Keys `. :arg rate: *'5/m'* The number of requests per unit time allowed. Valid units are: * ``s`` - seconds * ``m`` - minutes * ``h`` - hours * ``d`` - days Also accepts callables. See :ref:`Rates `. A rate of ``0/s`` disallows all requests. A rate of ``None`` means "no limit" and will allow all requests. :arg method: *ALL* Which HTTP method(s) to rate-limit. May be a string, a list/tuple of strings, or the special values for ``ALL`` or ``UNSAFE`` (which includes ``POST``, ``PUT``, ``DELETE`` and ``PATCH``). :arg block: *False* Whether to block the request instead of annotating. HTTP Methods ------------ Each decorator can be limited to one or more HTTP methods. The ``method=`` argument accepts a method name (e.g. ``'GET'``) or a list or tuple of strings (e.g. ``('GET', 'OPTIONS')``). There are two special shortcuts values, both accessible from the ``ratelimit`` decorator or the ``is_ratelimited`` helper, as well as on the root ``ratelimit`` module: .. code-block:: python from ratelimit.decorators import ratelimit @ratelimit(key='ip', method=ratelimit.ALL) @ratelimit(key='ip', method=ratelimit.UNSAFE) def myview(request): pass ``ratelimit.ALL`` applies to all HTTP methods. ``ratelimit.UNSAFE`` is a shortcut for ``('POST', 'PUT', 'PATCH', 'DELETE')``. Examples -------- .. code-block:: python @ratelimit(key='ip', rate='5/m') def myview(request): # Will be true if the same IP makes more than 5 POST # requests/minute. was_limited = getattr(request, 'limited', False) return HttpResponse() @ratelimit(key='ip', rate='5/m', block=True) def myview(request): # If the same IP makes >5 reqs/min, will raise Ratelimited return HttpResponse() @ratelimit(key='post:username', rate='5/m', method=['GET', 'POST']) def login(request): # If the same username is used >5 times/min, this will be True. # The `username` value will come from GET or POST, determined by the # request method. was_limited = getattr(request, 'limited', False) return HttpResponse() @ratelimit(key='post:username', rate='5/m') @ratelimit(key='post:tenant', rate='5/m') def login(request): # Use multiple keys by stacking decorators. return HttpResponse() @ratelimit(key='get:q', rate='5/m') @ratelimit(key='post:q', rate='5/m') def search(request): # These two decorators combine to form one rate limit: the same search # query can only be tried 5 times a minute, regardless of the request # method (GET or POST) return HttpResponse() @ratelimit(key='ip', rate='4/h') def slow(request): # Allow 4 reqs/hour. return HttpResponse() rate = lambda g, r: None if r.user.is_authenticated else '100/h' @ratelimit(key='ip', rate=rate) def skipif1(request): # Only rate limit anonymous requests return HttpResponse() @ratelimit(key='user_or_ip', rate='10/s') @ratelimit(key='user_or_ip', rate='100/m') def burst_limit(request): # Implement a separate burst limit. return HttpResponse() @ratelimit(group='expensive', key='user_or_ip', rate='10/h') def expensive_view_a(request): return something_expensive() @ratelimit(group='expensive', key='user_or_ip', rate='10/h') def expensive_view_b(request): # Shares a counter with expensive_view_a return something_else_expensive() @ratelimit(key='header:x-cluster-client-ip') def post(request): # Uses the X-Cluster-Client-IP header value. return HttpResponse() @ratelimit(key=lambda g, r: r.META.get('HTTP_X_CLUSTER_CLIENT_IP', r.META['REMOTE_ADDR']) def myview(request): # Use `X-Cluster-Client-IP` but fall back to REMOTE_ADDR. return HttpResponse() Class-Based Views ----------------- .. versionadded:: 0.5 .. versionchanged:: 3.0 To use the ``@ratelimit`` decorator with class-based views, use the Django ``@method_decorator``: .. code-block:: python from django.utils.decorators import method_decorator from django.views.generic import View class MyView(View): @method_decorator(ratelimit(key='ip', rate='1/m', method='GET')) def get(self, request): pass @method_decorator(ratelimit(key='ip', rate='1/m', method='GET'), name='get') class MyOtherView(View): def get(self, request): pass It is also possible to wrap a whole view later, e.g.: .. code-block:: python from django.urls import path from myapp.views import MyView from ratelimit.decorators import ratelimit urlpatterns = [ path('/', ratelimit(key='ip', method='GET', rate='1/m')(MyView.as_view())), ] .. warning:: Make sure the ``method`` argument matches the method decorated. .. note:: Unless given an explicit ``group`` argument, different methods of a class-based view will be limited separate. .. _usage-helper: Core Methods ============ .. versionadded:: 3.0 In some cases the decorator is not flexible enough to, e.g., conditionally apply rate limits. In these cases, you can access the core functionality in ``ratelimit.core``. The two major methods are ``get_usage`` and ``is_ratelimited``. .. code-block:: python from ratelimit.core import get_usage, is_ratelimited .. py:function:: get_usage(request, group=None, fn=None, key=None, \ rate=None, method=ALL, increment=False) :arg request: *None* The HTTPRequest object. :arg group: *None* A group of rate limits to count together. Defaults to the dotted name of the view. :arg fn: *None* A view function which can be used to calculate the group as if it was decorated by :ref:`@ratelimit `. :arg key: What key to use, see :ref:`Keys `. :arg rate: *'5/m'* The number of requests per unit time allowed. Valid units are: * ``s`` - seconds * ``m`` - minutes * ``h`` - hours * ``d`` - days Also accepts callables. See :ref:`Rates `. :arg method: *ALL* Which HTTP method(s) to rate-limit. May be a string, a list/tuple, or ``None`` for all methods. :arg increment: *False* Whether to increment the count or just check. :returns dict or None: Either returns None, indicating that ratelimiting was not active for this request (for some reason) or returns a dict including the current count, limit, time left in the window, and whether this request should be limited. .. py:function:: is_ratelimited(request, group=None, fn=None, \ key=None, rate=None, method=ALL, \ increment=False) :arg request: *None* The HTTPRequest object. :arg group: *None* A group of rate limits to count together. Defaults to the dotted name of the view. :arg fn: *None* A view function which can be used to calculate the group as if it was decorated by :ref:`@ratelimit `. :arg key: What key to use, see :ref:`Keys `. :arg rate: *'5/m'* The number of requests per unit time allowed. Valid units are: * ``s`` - seconds * ``m`` - minutes * ``h`` - hours * ``d`` - days Also accepts callables. See :ref:`Rates `. :arg method: *ALL* Which HTTP method(s) to rate-limit. May be a string, a list/tuple, or ``None`` for all methods. :arg increment: *False* Whether to increment the count or just check. :returns bool: Whether this request should be limited or not. ``is_ratelimited`` is a thin wrapper around ``get_usage`` that is maintained for compatibility. It provides strictly less information. .. warning:: ``get_usage`` and ``is_ratelimited`` require either ``group=`` or ``fn=`` to be passed, or they cannot determine the rate limiting state and will throw. .. _usage-exception: Exceptions ========== .. py:class:: ratelimit.exceptions.Ratelimited If a request is ratelimited and ``block`` is set to ``True``, Ratelimit will raise ``ratelimit.exceptions.Ratelimited``. This is a subclass of Django's ``PermissionDenied`` exception, so if you don't need any special handling beyond the built-in 403 processing, you don't have to do anything. If you are setting |handler403|_ in your root URLconf, you can catch this exception in your custom view to return a different response, for example: .. code-block:: python def handler403(request, exception=None): if isinstance(exception, Ratelimited): return HttpResponse('Sorry you are blocked', status=429) return HttpResponseForbidden('Forbidden') .. |handler403| replace:: ``handler403`` .. _handler403: https://docs.djangoproject.com/en/2.1/topics/http/urls/#error-handling .. _usage-middleware: Middleware ========== There is optional middleware to use a custom view to handle ``Ratelimited`` exceptions. To use it, add ``ratelimit.middleware.RatelimitMiddleware`` to your ``MIDDLEWARE`` (toward the bottom of the list) and set ``RATELIMIT_VIEW`` to the full path of a view you want to use. The view specified in ``RATELIMIT_VIEW`` will get two arguments, the ``request`` object (after ratelimit processing) and the exception. django-ratelimit-3.0.1/ratelimit/000077500000000000000000000000001370710114700167405ustar00rootroot00000000000000django-ratelimit-3.0.1/ratelimit/__init__.py000066400000000000000000000002411370710114700210460ustar00rootroot00000000000000VERSION = (3, 0, 1) __version__ = '.'.join(map(str, VERSION)) ALL = (None,) # Sentinel value for all HTTP methods. UNSAFE = ['DELETE', 'PATCH', 'POST', 'PUT'] django-ratelimit-3.0.1/ratelimit/core.py000066400000000000000000000145331370710114700202500ustar00rootroot00000000000000import ipaddress import functools import hashlib import re import time import zlib from django.conf import settings from django.core.cache import caches from django.core.exceptions import ImproperlyConfigured from django.utils.module_loading import import_string from ratelimit import ALL, UNSAFE __all__ = ['is_ratelimited', 'get_usage'] _PERIODS = { 's': 1, 'm': 60, 'h': 60 * 60, 'd': 24 * 60 * 60, } # Extend the expiration time by a few seconds to avoid misses. EXPIRATION_FUDGE = 5 def ip_mask(ip): if ':' in ip: # IPv6 mask = getattr(settings, 'RATELIMIT_IPV6_MASK', 64) else: # IPv4 mask = getattr(settings, 'RATELIMIT_IPV4_MASK', 32) network = ipaddress.ip_network('{}/{}'.format(ip, mask), strict=False) return str(network.network_address) def user_or_ip(request): if request.user.is_authenticated: return str(request.user.pk) return ip_mask(request.META['REMOTE_ADDR']) _SIMPLE_KEYS = { 'ip': lambda r: ip_mask(r.META['REMOTE_ADDR']), 'user': lambda r: str(r.user.pk), 'user_or_ip': user_or_ip, } def get_header(request, header): key = 'HTTP_' + header.replace('-', '_').upper() return request.META.get(key, '') _ACCESSOR_KEYS = { 'get': lambda r, k: r.GET.get(k, ''), 'post': lambda r, k: r.POST.get(k, ''), 'header': get_header, } def _method_match(request, method=ALL): if method == ALL: return True if not isinstance(method, (list, tuple)): method = [method] return request.method in [m.upper() for m in method] rate_re = re.compile(r'([\d]+)/([\d]*)([smhd])?') def _split_rate(rate): if isinstance(rate, tuple): return rate count, multi, period = rate_re.match(rate).groups() count = int(count) if not period: period = 's' seconds = _PERIODS[period.lower()] if multi: seconds = seconds * int(multi) return count, seconds def _get_window(value, period): ts = int(time.time()) if period == 1: return ts if not isinstance(value, bytes): value = value.encode('utf-8') w = ts - (ts % period) + (zlib.crc32(value) % period) if w < ts: return w + period return w def _make_cache_key(group, window, rate, value, methods): count, period = _split_rate(rate) safe_rate = '%d/%ds' % (count, period) parts = [group, safe_rate, value, str(window)] if methods is not None: if methods == ALL: methods = '' elif isinstance(methods, (list, tuple)): methods = ''.join(sorted([m.upper() for m in methods])) parts.append(methods) prefix = getattr(settings, 'RATELIMIT_CACHE_PREFIX', 'rl:') return prefix + hashlib.md5(u''.join(parts).encode('utf-8')).hexdigest() def is_ratelimited(request, group=None, fn=None, key=None, rate=None, method=ALL, increment=False): usage = get_usage(request, group, fn, key, rate, method, increment) if usage is None: return False return usage['should_limit'] def get_usage(request, group=None, fn=None, key=None, rate=None, method=ALL, increment=False): if group is None and fn is None: raise ImproperlyConfigured('get_usage must be called with either ' '`group` or `fn` arguments') if not getattr(settings, 'RATELIMIT_ENABLE', True): return None if not _method_match(request, method): return None if group is None: parts = [] if isinstance(fn, functools.partial): fn = fn.func # Django <2.1 doesn't use a partial. This is ugly and inelegant, but # throwing __qualname__ into the list below helps. if fn.__name__ == 'bound_func': fn = fn.__closure__[0].cell_contents if hasattr(fn, '__module__'): parts.append(fn.__module__) if hasattr(fn, '__self__'): parts.append(fn.__self__.__class__.__name__) parts.append(fn.__qualname__) group = '.'.join(parts) if callable(rate): rate = rate(group, request) elif isinstance(rate, str) and '.' in rate: ratefn = import_string(rate) rate = ratefn(group, request) if rate is None: return None limit, period = _split_rate(rate) if period <= 0: raise ImproperlyConfigured('Ratelimit period must be greater than 0') if not key: raise ImproperlyConfigured('Ratelimit key must be specified') if callable(key): value = key(group, request) elif key in _SIMPLE_KEYS: value = _SIMPLE_KEYS[key](request) elif ':' in key: accessor, k = key.split(':', 1) if accessor not in _ACCESSOR_KEYS: raise ImproperlyConfigured('Unknown ratelimit key: %s' % key) value = _ACCESSOR_KEYS[accessor](request, k) elif '.' in key: keyfn = import_string(key) value = keyfn(group, request) else: raise ImproperlyConfigured( 'Could not understand ratelimit key: %s' % key) window = _get_window(value, period) initial_value = 1 if increment else 0 cache_name = getattr(settings, 'RATELIMIT_USE_CACHE', 'default') cache = caches[cache_name] cache_key = _make_cache_key(group, window, rate, value, method) count = None added = cache.add(cache_key, initial_value, period + EXPIRATION_FUDGE) if added: count = initial_value else: if increment: try: # python3-memcached will throw a ValueError if the server is # unavailable or (somehow) the key doesn't exist. redis, on the # other hand, simply returns None. count = cache.incr(cache_key) except ValueError: pass else: count = cache.get(cache_key, initial_value) # Getting or setting the count from the cache failed if count is None: if getattr(settings, 'RATELIMIT_FAIL_OPEN', False): return None return { 'count': 0, 'limit': 0, 'should_limit': True, 'time_left': -1, } time_left = window - int(time.time()) return { 'count': count, 'limit': limit, 'should_limit': count > limit, 'time_left': time_left, } is_ratelimited.ALL = ALL is_ratelimited.UNSAFE = UNSAFE get_usage.ALL = ALL get_usage.UNSAFE = UNSAFE django-ratelimit-3.0.1/ratelimit/decorators.py000066400000000000000000000016251370710114700214630ustar00rootroot00000000000000from __future__ import absolute_import from functools import wraps from ratelimit import ALL, UNSAFE from ratelimit.exceptions import Ratelimited from ratelimit.core import is_ratelimited __all__ = ['ratelimit'] def ratelimit(group=None, key=None, rate=None, method=ALL, block=False): def decorator(fn): @wraps(fn) def _wrapped(request, *args, **kw): old_limited = getattr(request, 'limited', False) ratelimited = is_ratelimited(request=request, group=group, fn=fn, key=key, rate=rate, method=method, increment=True) request.limited = ratelimited or old_limited if ratelimited and block: raise Ratelimited() return fn(request, *args, **kw) return _wrapped return decorator ratelimit.ALL = ALL ratelimit.UNSAFE = UNSAFE django-ratelimit-3.0.1/ratelimit/exceptions.py000066400000000000000000000001441370710114700214720ustar00rootroot00000000000000from django.core.exceptions import PermissionDenied class Ratelimited(PermissionDenied): pass django-ratelimit-3.0.1/ratelimit/middleware.py000066400000000000000000000010341370710114700214250ustar00rootroot00000000000000from django.conf import settings from django.utils.module_loading import import_string from ratelimit.exceptions import Ratelimited class RatelimitMiddleware: def __init__(self, get_response): self.get_response = get_response def __call__(self, request): return self.get_response(request) def process_exception(self, request, exception): if not isinstance(exception, Ratelimited): return None view = import_string(settings.RATELIMIT_VIEW) return view(request, exception) django-ratelimit-3.0.1/ratelimit/models.py000066400000000000000000000000501370710114700205700ustar00rootroot00000000000000# This module intentionally left blank. django-ratelimit-3.0.1/ratelimit/tests.py000066400000000000000000000443371370710114700204670ustar00rootroot00000000000000from functools import partial from django.core.cache import cache, InvalidCacheBackendError from django.core.exceptions import ImproperlyConfigured from django.test import RequestFactory, TestCase from django.test.utils import override_settings from django.utils.decorators import method_decorator from django.views.generic import View from ratelimit.decorators import ratelimit from ratelimit.exceptions import Ratelimited from ratelimit.core import get_usage, is_ratelimited, _split_rate rf = RequestFactory() class MockUser(object): def __init__(self, authenticated=False): self.pk = 1 self.is_authenticated = authenticated class RateParsingTests(TestCase): def test_simple(self): tests = ( ('100/s', (100, 1)), ('100/10s', (100, 10)), ('100/10', (100, 10)), ('100/m', (100, 60)), ('400/10m', (400, 600)), ('1000/h', (1000, 3600)), ('800/d', (800, 24 * 60 * 60)), ) for i, o in tests: assert o == _split_rate(i) def callable_rate(group, request): if request.user.is_authenticated: return None return (0, 1) def mykey(group, request): return request.META['REMOTE_ADDR'][::-1] class RatelimitTests(TestCase): def setUp(self): cache.clear() def test_no_key(self): @ratelimit(rate='1/m', block=True) def view(request): return True req = rf.get('/') with self.assertRaises(ImproperlyConfigured): view(req) def test_ip(self): @ratelimit(key='ip', rate='1/m') def view(request): return request.limited assert not view(rf.get('/')), 'First request works.' assert view(rf.get('/')), 'Second request is limited' def test_block(self): @ratelimit(key='ip', rate='1/m', block=True) def blocked(request): return request.limited assert not blocked(rf.get('/')), 'First request works.' with self.assertRaises(Ratelimited): blocked(rf.get('/')), 'Second request is blocked.' def test_method(self): @ratelimit(key='ip', method='POST', rate='1/m', group='a') def limit_post(request): return request.limited assert not limit_post(rf.post('/')), 'Do not limit first POST.' assert limit_post(rf.post('/')), 'Limit second POST.' assert not limit_post(rf.get('/')), 'Do not limit GET.' def test_unsafe_methods(self): @ratelimit(key='ip', method=ratelimit.UNSAFE, rate='0/m') def limit_unsafe(request): return request.limited assert not limit_unsafe(rf.get('/')) assert not limit_unsafe(rf.head('/')) assert not limit_unsafe(rf.options('/')) assert limit_unsafe(rf.delete('/')) assert limit_unsafe(rf.post('/')) assert limit_unsafe(rf.put('/')) assert limit_unsafe(rf.patch('/')) def test_key_get(self): @ratelimit(key='get:foo', rate='1/m', method='GET') def view(request): return request.limited assert not view(rf.get('/', {'foo': 'a'})) assert view(rf.get('/', {'foo': 'a'})) assert not view(rf.get('/', {'foo': 'b'})) assert view(rf.get('/', {'foo': 'b'})) def test_key_post(self): @ratelimit(key='post:foo', rate='1/m') def view(request): return request.limited assert not view(rf.post('/', {'foo': 'a'})) assert view(rf.post('/', {'foo': 'a'})) assert not view(rf.post('/', {'foo': 'b'})) assert view(rf.post('/', {'foo': 'b'})) def test_key_header(self): def _req(): req = rf.post('/') req.META['HTTP_X_REAL_IP'] = '1.2.3.4' return req @ratelimit(key='header:x-real-ip', rate='1/m') @ratelimit(key='header:x-missing-header', rate='1/m') def view(request): return request.limited assert not view(_req()) assert view(_req()) def test_rate(self): @ratelimit(key='ip', rate='2/m') def twice(request): return request.limited assert not twice(rf.post('/')), 'First request is not limited.' assert not twice(rf.post('/')), 'Second request is not limited.' assert twice(rf.post('/')), 'Third request is limited.' def test_zero_rate(self): @ratelimit(key='ip', rate='0/m') def never(request): return request.limited assert never(rf.post('/')) def test_none_rate(self): @ratelimit(key='ip', rate=None) def always(request): return request.limited assert not always(rf.post('/')) assert not always(rf.post('/')) assert not always(rf.post('/')) assert not always(rf.post('/')) assert not always(rf.post('/')) assert not always(rf.post('/')) assert not always(rf.post('/')) def test_callable_rate(self): def _req(auth): req = rf.post('/') req.user = MockUser(authenticated=auth) return req def get_rate(group, request): if request.user.is_authenticated: return (2, 60) return (1, 60) @ratelimit(key='user_or_ip', rate=get_rate) def view(request): return request.limited assert not view(_req(auth=False)) assert view(_req(auth=False)) assert not view(_req(auth=True)) assert not view(_req(auth=True)) assert view(_req(auth=True)) def test_callable_rate_none(self): def _req(never_limit=False): req = rf.post('/') req.never_limit = never_limit return req get_rate = lambda g, r: None if r.never_limit else '1/m' @ratelimit(key='ip', rate=get_rate) def view(request): return request.limited assert not view(_req()) assert view(_req()) assert not view(_req(never_limit=True)) assert not view(_req(never_limit=True)) def test_callable_rate_zero(self): def _req(auth): req = rf.post('/') req.user = MockUser(authenticated=auth) return req def get_rate(group, request): if request.user.is_authenticated: return '1/m' return '0/m' @ratelimit(key='ip', rate=get_rate) def view(request): return request.limited assert view(_req(auth=False)) assert not view(_req(auth=True)) assert view(_req(auth=True)) def test_callable_rate_import(self): def _req(auth): req = rf.post('/') req.user = MockUser(authenticated=auth) return req @ratelimit(key='user_or_ip', rate='ratelimit.tests.callable_rate') def view(request): return request.limited assert view(_req(auth=False)) assert not view(_req(auth=True)) def test_user_or_ip(self): """Allow custom functions to set cache keys.""" def _req(auth): req = rf.post('/') req.user = MockUser(authenticated=auth) return req @ratelimit(key='user_or_ip', rate='1/m', block=False) def view(request): return request.limited assert not view(_req(auth=False)) assert view(_req(auth=False)) auth = rf.post('/') auth.user = MockUser(authenticated=True) assert not view(_req(auth=True)) assert view(_req(auth=True)) def test_callable_key_path(self): @ratelimit(key='ratelimit.tests.mykey', rate='1/m') def view(request): return request.limited assert not view(rf.post('/')) assert view(rf.post('/')) def test_callable_key(self): @ratelimit(key=mykey, rate='1/m') def view(request): return request.limited assert not view(rf.post('/')) assert view(rf.post('/')) def test_stacked_decorator(self): """Allow @ratelimit to be stacked.""" # Put the shorter one first and make sure the second one doesn't # reset request.limited back to False. @ratelimit(rate='1/m', block=False, key=lambda x, y: 'min') @ratelimit(rate='10/d', block=False, key=lambda x, y: 'day') def view(request): return request.limited assert not view(rf.post('/')) assert view(rf.post('/')) def test_stacked_methods(self): """Different methods should result in different counts.""" @ratelimit(rate='1/m', key='ip', method='GET') @ratelimit(rate='1/m', key='ip', method='POST') def view(request): return request.limited assert not view(rf.get('/')) assert not view(rf.post('/')) assert view(rf.get('/')) assert view(rf.post('/')) def test_sorted_methods(self): """Order of the methods shouldn't matter.""" @ratelimit(rate='1/m', key='ip', method=['GET', 'POST'], group='a') def get_post(request): return request.limited @ratelimit(rate='1/m', key='ip', method=['POST', 'GET'], group='a') def post_get(request): return request.limited assert not get_post(rf.get('/')) assert post_get(rf.get('/')) def test_ratelimit_full_mask_v4(self): @ratelimit(rate='1/m', key='ip') def view(request): return request.limited with self.settings(RATELIMIT_IPV4_MASK=32): req = rf.get('/') req.META['REMOTE_ADDR'] = '10.1.1.1' assert not view(req) assert view(req) req = rf.get('/') req.META['REMOTE_ADDR'] = '10.1.1.2' assert not view(req) def test_ratelimit_full_mask_v6(self): @ratelimit(rate='1/m', key='ip') def view(request): return request.limited with self.settings(RATELIMIT_IPV6_MASK=128): req = rf.get('/') req.META['REMOTE_ADDR'] = '2001:db8::1000' assert not view(req) assert view(req) req = rf.get('/') req.META['REMOTE_ADDR'] = '2001:db8::1001' assert not view(req) def test_ratelimit_mask_v4(self): @ratelimit(rate='1/m', key='ip') def view(request): return request.limited with self.settings(RATELIMIT_IPV4_MASK=16): req = rf.get('/') req.META['REMOTE_ADDR'] = '10.1.1.1' assert not view(req) assert view(req) req = rf.get('/') req.META['REMOTE_ADDR'] = '10.1.0.1' assert view(req) req = rf.get('/') req.META['REMOTE_ADDR'] = '192.168.1.1' assert not view(req) def test_ratelimit_mask_v6(self): @ratelimit(rate='1/m', key='ip') def view(request): return request.limited with self.settings(RATELIMIT_IPV6_MASK=64): req = rf.get('/') req.META['REMOTE_ADDR'] = '2001:db8::1000' assert not view(req) assert view(req) req = rf.get('/') req.META['REMOTE_ADDR'] = '2001:db8::1001' assert view(req) req = rf.get('/') req.META['REMOTE_ADDR'] = '2001:db9::1000' assert not view(req) class FunctionsTests(TestCase): def setUp(self): cache.clear() def test_is_ratelimited(self): not_increment = partial(is_ratelimited, increment=False, rate='1/m', method=is_ratelimited.ALL, key='ip', group='a') # Does not increment. Count still 0. Does not rate limit # because 0 < 1. assert not not_increment(rf.get('/')) # Does not increment. Count still 1. Not limited because 1 > 1 # is false. assert not not_increment(rf.get('/')) def test_is_ratelimited_increment(self): do_increment = partial(is_ratelimited, increment=True, rate='1/m', method=is_ratelimited.ALL, key='ip', group='a') # Increments. Does not rate limit because 0 < 1. Count now 1. assert not do_increment(rf.get('/')) # Count = 2, 2 > 1. assert do_increment(rf.get('/')) def test_get_usage(self): _get_usage = partial(get_usage, method=get_usage.ALL, key='ip', rate='1/m', group='a') usage = _get_usage(rf.get('/')) self.assertEqual(usage['count'], 0) self.assertEqual(usage['limit'], 1) self.assertLessEqual(usage['time_left'], 60) self.assertFalse(usage['should_limit']) def test_get_usage_increment(self): _get_usage = partial(get_usage, method=get_usage.ALL, key='ip', rate='1/m', group='a', increment=True) _get_usage(rf.get('/')) usage = _get_usage(rf.get('/')) self.assertEqual(usage['count'], 2) self.assertEqual(usage['limit'], 1) self.assertLessEqual(usage['time_left'], 60) self.assertTrue(usage['should_limit']) def test_not_increment_after_increment(self): _get_usage = partial(get_usage, method=get_usage.ALL, key='ip', rate='1/m', group='a') _get_usage(rf.get('/'), increment=True) _get_usage(rf.get('/'), increment=True) usage = _get_usage(rf.get('/')) self.assertEqual(usage['count'], 2) self.assertEqual(usage['limit'], 1) self.assertLessEqual(usage['time_left'], 60) self.assertTrue(usage['should_limit']) def test_get_usage_called_without_group_or_fn(self): with self.assertRaises(ImproperlyConfigured): get_usage(rf.get('/'), key='ip') class RatelimitCBVTests(TestCase): def setUp(self): cache.clear() def test_method_decorator(self): class TestView(View): @method_decorator(ratelimit(key='ip', rate='1/m', block=False)) def post(self, request): return request.limited view = TestView.as_view() assert not view(rf.post('/')) assert view(rf.post('/')) def test_class_decorator(self): @method_decorator(ratelimit(key='ip', rate='1/m', block=False), name='get') class TestView(View): def get(self, request): return request.limited view = TestView.as_view() assert not view(rf.get('/')) assert view(rf.get('/')) def test_wrap_view(self): class TestView(View): def get(self, request): return request.limited view = TestView.as_view() wrapped = ratelimit(key='ip', rate='1/m', block=False)(view) assert not wrapped(rf.get('/')) assert wrapped(rf.get('/')) def test_methods_counted_separately(self): class TestView(View): @method_decorator(ratelimit(key='ip', rate='1/m', method='GET')) def get(self, request): return request.limited @method_decorator(ratelimit(key='ip', rate='1/m', method='POST')) def post(self, request): return request.limited view = TestView.as_view() assert not view(rf.get('/')) assert view(rf.get('/')) assert not view(rf.post('/')) def test_views_counted_separately(self): class TestView(View): @method_decorator(ratelimit(key='ip', rate='1/m', method='GET')) def get(self, request): return request.limited class AnotherTestView(View): @method_decorator(ratelimit(key='ip', rate='1/m', method='GET')) def get(self, request): return request.limited test_view = TestView.as_view() another_view = AnotherTestView.as_view() assert not test_view(rf.get('/')) assert test_view(rf.get('/')) assert not another_view(rf.get('/')) class CacheFailTests(TestCase): @override_settings(RATELIMIT_USE_CACHE='fake-cache') def test_bad_cache(self): @ratelimit(key='ip', rate='1/m') def view(request): return request.limited with self.assertRaises(InvalidCacheBackendError): view(rf.post('/')) @override_settings(RATELIMIT_USE_CACHE='connection-errors') def test_limit_on_cache_connection_error(self): @ratelimit(key='ip', rate='10/m') def view(request): return request.limited assert view(rf.post('/')) @override_settings(RATELIMIT_USE_CACHE='connection-errors', RATELIMIT_FAIL_OPEN=True) def test_fail_open_setting(self): @ratelimit(key='ip', rate='1/m') def view(request): return request.limited assert not view(rf.get('/')) assert not view(rf.get('/')) @override_settings(RATELIMIT_USE_CACHE='connection-errors') def test_is_ratelimited_cache_connection_error_without_increment(self): def not_increment(request): return is_ratelimited(request, increment=False, method=is_ratelimited.ALL, key='ip', rate='1/m', group='a') assert not not_increment(rf.get('/')) assert not not_increment(rf.get('/')) @override_settings(RATELIMIT_USE_CACHE='connection-errors') def test_is_ratelimited_cache_connection_error_with_increment(self): def do_increment(request): return is_ratelimited(request, increment=True, method=is_ratelimited.ALL, key='ip', rate='1/m', group='a') assert do_increment(rf.get('/')) assert do_increment(rf.get('/')) @override_settings(RATELIMIT_USE_CACHE='connection-errors-redis') def test_is_ratelimited_cache_connection_error_with_increment_redis(self): def do_increment(request): return is_ratelimited(request, increment=True, method=is_ratelimited.ALL, key='ip', rate='1/m', group='a') assert do_increment(rf.get('/')) assert do_increment(rf.get('/')) @override_settings(RATELIMIT_USE_CACHE='instant-expiration') def test_cache_timeout(self): @ratelimit(key='ip', rate='1/m', block=True) def view(request): return True assert view(rf.get('/')) assert view(rf.get('/')) django-ratelimit-3.0.1/run.sh000077500000000000000000000011401370710114700161050ustar00rootroot00000000000000#!/bin/bash export PYTHONPATH=".:$PYTHONPATH" export DJANGO_SETTINGS_MODULE="test_settings" usage() { echo "USAGE: $0 [command]" echo " test - run the ratelimit tests" echo " flake8 - run flake8" echo " shell - open the Django shell" exit 1 } case "$1" in "test" ) shift; echo "Django version: $(django-admin.py --version)" django-admin.py test ratelimit "$@";; "flake8" ) shift; echo "Flake8 version: $(flake8 --version)" flake8 "$@" ratelimit/;; "shell" ) django-admin.py shell ;; * ) usage ;; esac django-ratelimit-3.0.1/setup.cfg000066400000000000000000000000601370710114700165630ustar00rootroot00000000000000[bdist_wheel] universal=1 [flake8] ignore=E731 django-ratelimit-3.0.1/setup.py000066400000000000000000000030301370710114700164540ustar00rootroot00000000000000from setuptools import setup, find_packages from ratelimit import __version__ setup( name='django-ratelimit', version=__version__, description='Cache-based rate-limiting for Django.', long_description=open('README.rst').read(), author='James Socol', author_email='me@jamessocol.com', url='https://github.com/jsocol/django-ratelimit', license='Apache Software License', packages=find_packages(exclude=['test_settings']), python_requires='>=3.4', include_package_data=True, package_data={'': ['README.rst']}, classifiers=[ 'Development Status :: 5 - Production/Stable', 'Environment :: Web Environment', 'Framework :: Django', 'Framework :: Django :: 2.0', 'Framework :: Django :: 2.1', 'Framework :: Django :: 2.2', 'Framework :: Django :: 3.0', 'Intended Audience :: Developers', 'License :: OSI Approved :: Apache Software License', 'Operating System :: OS Independent', 'Programming Language :: Python', 'Programming Language :: Python :: 3', 'Programming Language :: Python :: 3.4', 'Programming Language :: Python :: 3.5', 'Programming Language :: Python :: 3.6', 'Programming Language :: Python :: 3.7', 'Programming Language :: Python :: 3.8', 'Programming Language :: Python :: Implementation :: CPython', 'Programming Language :: Python :: Implementation :: PyPy', 'Topic :: Software Development :: Libraries :: Python Modules', ] ) django-ratelimit-3.0.1/test_settings.py000066400000000000000000000015541370710114700202240ustar00rootroot00000000000000SECRET_KEY = 'ratelimit' INSTALLED_APPS = ( 'ratelimit', ) RATELIMIT_USE_CACHE = 'default' CACHES = { 'default': { 'BACKEND': 'django.core.cache.backends.locmem.LocMemCache', 'LOCATION': 'ratelimit-tests', }, 'connection-errors': { 'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache', 'LOCATION': 'test-connection-errors', }, 'connection-errors-redis': { 'BACKEND': 'django_redis.cache.RedisCache', 'LOCATION': 'redis://test-connection-errors', 'OPTIONS': { 'IGNORE_EXCEPTIONS': True, } }, 'instant-expiration': { 'BACKEND': 'django.core.cache.backends.dummy.DummyCache', 'LOCATION': 'test-instant-expiration', }, } DATABASES = { 'default': { 'ENGINE': 'django.db.backends.sqlite3', 'NAME': 'test.db', }, } django-ratelimit-3.0.1/tox.ini000066400000000000000000000010651370710114700162630ustar00rootroot00000000000000[tox] envlist = py34-django{111,20}, py35-django{111,20,21,22b}, py36-django{111,20,21,22b,master}, py37-django{20,21,22b,master}, pypy35-django{111,20,21,22b,master}, [testenv] deps = django111: Django>=1.11,<1.12 django20: Django>=2.0,<2.1 django21: Django>=2.1,<2.2 django22b: https://github.com/django/django/archive/stable/2.2.x.tar.gz djangomaster: https://github.com/django/django/archive/master.tar.gz python3-memcached>=1.51 django-redis==4.10.0 flake8 commands = ./run.sh test ./run.sh flake8