Skip to content

feat: Pageload rate-limiting by IP for donate page

stephen requested to merge ip-rate-limiting into main

This commit implements basic measures against attacks that operate by rapidly accessing the site through HTTP.

  • The package django-ratelimit was added to the pyproject.toml manifest and poetry.lock was regenerated in turn.
  • In settings.py, we define a simple backend cache for Django to use. Because Django shares Redis with CiviCRM, we are only utilizing this cache for the purposes of giving django-ratelimit a backend in order to keep that shared pool unpolluted and traffic low. In the future, if it is desirable, use of this backend cache could be expanded to cover actual page cacheing, etc.
  • The URL pattern defined for the donate page in urls.py wraps the DonateFormView.as_view() call in a ratelimit call which defines the method rate-limited against, the method by which access is tracked (in this case, "ip"), and the allowed rate of access.

Merge request reports