Why is there an Anubis gate in front of Search for logged-in users?
22 points by hawski
22 points by hawski
When one goes to Search on lobste.rs there is an Anubis gate first. I understand why it is there for a public rate limiting case, but why is it there for logged-in users? This is an invite only site and if anyone would hammer the server too much they are logged in so they can already be rate limited based on their identity.
Am I missing something or is it a configuration problem?
At the time when I wrote the configuration, there did not seem to be a way to check for the cookies a logged in user would have. It's also worth noting that we use Hatchbox to deploy the site, so we aren't in "full" control of the Caddy configuration. We are somewhat "locked" into the Caddy -> Anubis -> Rails flow.
If folks have suggestions or tweaks to the configuration, please feel free to make a pull request.
The approach I might take would be to set a synthetic request header in Caddyfile.pre based on the existing has_user_cookie there, and then switch on that in the Anubis config. That's not impossible to bypass, but I bet it'd be enough.
You could also look for the presence of the lobster_trap cookie specifically, but to be really secure you'd have to bounce any user with an invalid cookie to the login page (or otherwise refuse expensive requests in the rails app [without a valid anubis cookie?], because they're already past anubis).
Anyway, if that first idea seems reasonable, I'll try to come up with a PR tonight.
This is discussed on GitHub: https://github.com/lobsters/lobsters/issues/1781
Seems like pushcx just added the filter to the endpoint in general, would be nice to have an exemption for logged in users.
Is it something related/similar that sessions get logged out fairly often since a few months now? I am getting tired of logging back in.