rack-attack DSL

rack-attack.rb

# NB: `req` is a Rack::Request object (basically an env hash with friendly accessor methods)

# Throttle 10 requests/ip/second
# NB: return value of block is key name for counter
#     falsy values bypass throttling
Rack::Attack.throttle("req/ip", :limit => 10, :period => 1.second) { |req| req.ip }


# Block cloud IPs from accessing PATH regexp
Rack::Attack.block "bad_ips from logging in" do |req|
  req.path =~ /^login/ && bad_ips.include?(req.ip)
end

# Throttle login attempts
Rack::Attack.throttle "logins/ip", :limit => 2, :period => 1.second do | req|
  req.ip if req.post? && req.path_info =~ /^login/
end

# Whitelist a User-Agent
Rack::Attack.whitelist 'internal user agent' do |req|
  req.user_agent =~ 'InternalUserAgent'
end

Back to what I was saying on ordering - putting the whitelist last is confusing since you don't specify the order, you just have to know that a whitelist will bypass everything (which, I think I agree with you on ;))