Rename Rack Attack log field: request_method -> method
What does this MR do and why?
method is what is used in the API and controller logs. Keeping this
the same makes it easier to filter for logs properly.
References
Relates to gitlab-com/gl-infra/production#19438 (comment 2385407012)
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
How to set up and validate locally
- Enable Rack Attack: in
/admin->Settings->Network, checkEnable unauthenticated API request rate limit, and clickSave. - Be careful: lower the limits of unauthenticated API requests to a low value (e.g. 5). Note that this might lock you out.
😄 -
gdk restart rails-webfor the limits to take effect. - Hit
curl http://gdk.test:3000/api/v4/usersat least N times. - Check
log/auth_json.log:
"severity": "ERROR",
"time": "2025-03-07T19:54:15.246Z",
"correlation_id": "01JNS2RDQVMXXCTZBNTZQ88DSH",
"message": "Rack_Attack",
"env": "throttle",
"remote_ip": "127.0.0.1",
"method": "GET",
"path": "/api/v4/user",
"matched": "throttle_unauthenticated_api",
"status": 429,
"redis_calls": 2,
<snip>
- Disable Rack Attack.
Edited by Stan Hu