Remove the Rack::Attack middleware from the request path

Problem

Once self-managed has soaked on labkit as sole enforcer and the spec coverage is re-homed, the Rack::Attack middleware is dead weight: installed in every request path but safelisted into a pass-through everywhere.

Solution

  • Remove both safelists, and ThrottleRegistry.fully_enforced? along with them (lib/gitlab/rack_attack.rb:125). Depends on #29663, which removes the six cohort flags and collapses LabkitRackRateLimit to enforce-only. While the flags still exist, dropping the safelist early would let Rack::Attack double-enforce for anyone who turns a cohort off.
  • Remove Rack::Attack from the middleware stack; re-anchor LabkitRackRateLimit and RackAttackHeaders (both anchored to Rack::Attack in config/application.rb:472-480) to Warden::Manager.
  • Delete Gitlab::RackAttack.configure / configure_throttles / throttled_responder / throttle_or_track and config/initializers/rack_attack.rb, relocating the Rack::Attack.cache.store assignment (lib/gitlab/rack_attack.rb:22): Rack::Attack::Allow2Ban (login/git-basic-auth IP banning, lib/gitlab/auth/ip_rate_limiter.rb) reads that store and would otherwise silently fall back to Rails.cache.
  • Delete lib/gitlab/metrics/subscribers/rack_attack.rb (the gitlab_rack_attack_* metrics) and its payload consumption in lib/gitlab/instrumentation_helper.rb:97-101.
  • Delete Rack::Attack-only specs (the global spec, shared examples, subscriber spec, spec/requests/labkit_rack_rate_limit_fully_enforced_spec.rb whose subject is the safelist, EE equivalents), the dead Gitlab::Throttle.omnibus_protected_paths_present? (lib/gitlab/throttle.rb:21-23), and matching .rubocop_todo/ and .labkit_logging_todo.yml entries.

Keep, load-bearing:

  • the rack-attack gem itself (Allow2Ban has no replacement; deliberately out of scope for now)
  • Gitlab::RackAttack.all_throttle_definitions / ThrottleDefinition (single source of limits, read by the labkit throttle registry), track?, user_allowlist / UserAllowlist, Store, RequestThrottleData
  • the Request mixin until #29247 (closed)
  • everything under lib/gitlab/rack_attack/labkit_rate_limit/, Gitlab::Throttle, all throttle_* application settings and their admin UI/API (no column drops)
  • the Rack::Request#trusted_proxy? patch in config/initializers/trusted_proxies.rb (labkit's ClassifiedRequest inherits from ::Rack::Request and needs correct #ip); update its rack-attack comment.
Edited by Nidhey Indurkar