Roda's minimalism is a double-edged sword. By default, it provides zero protection against resource exhaustion or brute-force attacks. If you aren't throttling at the Rack level, an attacker can saturate your worker pool and spike CPU via expensive operations like password hashing or complex database queries. We solve this by implementing Rack::Attack to intercept malicious traffic before it hits the Roda routing tree.

The Vulnerable Pattern

class App < Roda
  route do |r|
    r.on 'api' do
      r.post 'login' do
        # VULNERABLE: No rate limiting. 
        # Attacker can trigger bcrypt/argon2 hashing thousands of times per second,
        # leading to CPU exhaustion and Denial of Service (DoS).
        user = User.authenticate(r.params['user'], r.params['pass'])
        user ? 'Success' : 'Unauthorized'
      end
    end
  end
end

The Secure Implementation

The fix moves the defense-in-depth strategy to the Rack middleware layer. By using Rack::Attack, we define a throttle policy that tracks requests by IP address using a cache store. When a client exceeds the defined threshold (5 requests per 20s), the middleware intercepts the request and returns a 429 Too Many Requests response. This happens before the request ever reaches the Roda routing tree, ensuring that expensive CPU-bound tasks like password verification or heavy SQL queries never execute for abusive clients, effectively neutralizing resource exhaustion vectors.

require 'rack/attack'
Configure Rack::Attack middleware
Rack::Attack.cache.store = ActiveSupport::Cache::MemoryStore.new
Throttle login attempts: 5 requests per 20 seconds per IP
Rack::Attack.throttle(‘logins/ip’, limit: 5, period: 20) do |req|
if req.path == ‘/api/login’ && req.post?
req.ip
end
end
class App < Roda
Inject protection at the top of the stack
use Rack::Attack
route do |r|
r.on ‘api’ do
r.post ‘login’ do
user = User.authenticate(r.params[‘user’], r.params[‘pass’])
user ? ‘Success’ : ‘Unauthorized’
end
end
end
end