Consider relative URL root in Rack::Attack::Request

Alex Kalderimisrequested to merge
351306-rate-limits-don-t-consider-relative-url-root-if-set into master

What does this MR do and why?

Addresses #351306 (closed) by ensuring we take the relative root URL into account when performing checks in Rack::Attack::Request.

Previously, Request#path would have the value /some-path/prefix/api, which means that tests such as path.start_with?('/api') would fail.

Uses of path are replaced with logical_path, which is the path with the relative path prefix removed.

How to set up and validate locally

  1. Enable a relative path prefix (see https://docs.gitlab.com/ee/install/relative_url.html) in your development enviroment.
  2. Make any requests (the use of the /-/graphql-explorer is a good idea here, since it makes many requests to the /api/graphql endpoint).
  3. Observe that the requests are identified as API requests.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #351306 (closed)

Edited by Alex Kalderimis

Merge request reports