Exclude: home-page and user signin/signup limit checks for un-authenticated users

What does this MR do and why?

Logged-out visitors from an IP that has used up its unauthenticated_traffic_per_ip allowance get a 429 on the home page (/). That blocks the usual path to sign-in and sign-up. A sign-in exclusion already exists, but users can't reach it from the home page. Several sign-up and recovery endpoints are also still counted, which can block account creation.

This MR adds these routes to the unauthenticated_traffic_per_ip exclusion list in ee/lib/ee/gitlab/rate_limit/plan_rules.rb:

• Home page: / only. /o/<org> is the Organization's own page and stays counted.
• Sign-up flow:
  • /users (sign-up submit)
  • /users/sign_up
  • /users/password/complexity
  • /users/:username/exists
  • /users/identity_verification(/...)
  • /-/arkose/data_exchange_payload
• Account recovery: /users/password, /users/password/new, /users/password/edit, /users/confirmation(/new) and /users/unlock(/new).
• Trial registration: /-/trial_registrations(/new).

Except for the home page, these routes also match under an /o/<org> prefix.

Design choices

• Rules can't match on HTTP method, so each excluded path is excluded for every method. This includes the POSTs that submit sign-up, password reset, confirmation, unlock and trial registration.
• The username check uses the browser's pattern, which allows .git and .atom endings. That way every check the form sends is covered.
• Abuse protection stays per IP through throttle_unauthenticated_web and protected paths. On gprd, unauthenticated_traffic_per_ip is 60 per 3600s and unauthenticated_web is 500 per 60s. So on every excluded request the per-IP ceiling goes from 60/hour to 30,000/hour.
• Signed-in users are unaffected. A spec confirms GET / still counts against burst_web_traffic_per_user_free_plan_log.

References

• Closes gitlab-com/gl-infra/production-engineering#30223
• Part of the epic Rate Limits · Platform & framework delivery
• Choosing a rate limiter

Screenshots or screen recordings

Not applicable. There are no UI changes.

How to set up and validate locally

1. From an IP that has exhausted unauthenticated_traffic_per_ip, check that these load and no longer return 429: /, /users/sign_in, /users/sign_up, /users/password/new.
2. Check that other anonymous routes, such as issue pages and /o/<org>, still return 429.
3. While signed in, check that GET / still counts against the signed-in user's limit.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.