Grape is a lightweight REST-like API framework for Ruby, but its default state is 'open season' for resource exhaustion. Without explicit rate limiting, an attacker can flood endpoints to saturate CPU, memory, or database connection pools. To secure a Grape API, we must implement middleware that enforces request quotas and prevents automated abuse.

The Vulnerable Pattern

class BaseAPI < Grape::API
  format :json
resource :search do
desc ‘Heavy database query’
get do
# VULNERABILITY: No rate limiting.
# An attacker can script 1000s of requests/sec to exhaust DB connections.
Product.where(“name LIKE ?”, ”%#{params[:q]}%”)
end
end
end

The Secure Implementation

The fix involves integrating Rack::Attack middleware. The vulnerable code allows unlimited execution of heavy SQL queries, leading to Denial of Service (DoS). The secure implementation introduces a 'throttle' that tracks requests by IP address. If a client exceeds 10 requests per minute, the middleware intercepts the call and returns a '429 Too Many Requests' response before the Grape handler is even invoked, effectively shielding your application logic and database from exhaustion.

# 1. Add 'rack-attack' to Gemfile
# 2. Configure middleware (e.g., config/initializers/rack_attack.rb)
Rack::Attack.throttle('api/ip', limit: 10, period: 1.minute) do |req|
  req.ip if req.path.start_with?('/api')
end
3. Apply to Grape
class BaseAPI < Grape::API
use Rack::Attack
format :json
resource :search do
get do
Product.where(“name LIKE ?”, ”%#{params[:q]}%”)
end
end
end