ruby 40 lines · 7 steps

Throttling failed logins in Rails

A Rails sessions controller that rate-limits login attempts per IP and email using the cache store.

Explained by highlit
Rails Intermediate rate-limiting authentication caching sessions security
1class SessionsController < ApplicationController
2 MAX_ATTEMPTS = 5
3 THROTTLE_WINDOW = 15.minutes
4 
5 before_action :check_login_rate_limit, only: :create
6 
7 def create
8 user = User.find_by(email: params[:email].to_s.downcase)
9 
10 if user&.authenticate(params[:password])
11 Rails.cache.delete(throttle_key)
12 reset_session
13 session[:user_id] = user.id
14 redirect_to dashboard_path, notice: "Signed in successfully."
15 else
16 register_failed_attempt
17 flash.now[:alert] = "Invalid email or password."
18 render :new, status: :unprocessable_entity
19 end
20 end
21 
22 private
23 
24 def throttle_key
25 "login_attempts:#{request.remote_ip}:#{params[:email].to_s.downcase}"
26 end
27 
28 def check_login_rate_limit
29 attempts = Rails.cache.read(throttle_key).to_i
30 return if attempts < MAX_ATTEMPTS
31 
32 flash.now[:alert] = "Too many failed attempts. Try again in #{THROTTLE_WINDOW.inspect}."
33 render :new, status: :too_many_requests
34 end
35 
36 def register_failed_attempt
37 Rails.cache.increment(throttle_key, 1, expires_in: THROTTLE_WINDOW) ||
38 Rails.cache.write(throttle_key, 1, expires_in: THROTTLE_WINDOW)
39 end
40end
01 / 01
STEP 01

Walkthrough

Space play ←→ step click any line
Three takeaways
  1. 1A cache counter keyed by IP and email is a cheap, expiry-driven way to throttle abusive login attempts.
  2. 2Resetting the session and regenerating its id on successful login defends against session fixation.
  3. 3before_action lets you reject throttled requests before the expensive authentication logic ever runs.

Related explainers

ruby 
class ToastBroadcaster
  include ActionView::RecordIdentifier
 
  def self.broadcast_to(user, message:, type: :notice)

How Turbo Stream toasts broadcast in Rails

turbo-streams service-object real-time
Intermediate 6 steps
rust 
use axum::{extract::{Path, State}, http::StatusCode, Json};
use dashmap::DashMap;
use serde::Serialize;
use std::sync::Arc;

Request coalescing in an Axum handler

caching concurrency request-coalescing
Advanced 8 steps
ruby 
class TemplateInterpolator
  PLACEHOLDER = /\{\{\s*([\w.]+)\s*\}\}/
 
  def initialize(strict: false)

Interpolating templates with dotted keys in Ruby

regex string-interpolation hash-traversal
Intermediate 6 steps
ruby 
class KeyTransformer
  def self.camelize(data)
    new.camelize(data)
  end

Recursively camelizing nested Ruby data

recursion data-transformation pattern-matching
Intermediate 7 steps
ruby 
module Paginatable
  extend ActiveSupport::Concern
 
  private

A reusable pagination concern in Rails

pagination concerns http-headers
Intermediate 8 steps
ruby 
class Api::MessagesController < ApiController
  before_action :authenticate_api_key!
 
  rate_limit to: 100,

Layered API rate limiting in Rails

rate-limiting api-authentication throttling
Intermediate 9 steps

Share this explainer

Here's the card — post it anywhere.

Throttling failed logins in Rails — share card
Made with highlit — turn any snippet into a walkthrough like this in about a minute.
Explain your code