{"action":"created","issue":{"url":"https://api.github.com/repos/kickstarter/rack-attack/issues/123","labels_url":"https://api.github.com/repos/kickstarter/rack-attack/issues/123/labels{/name}","comments_url":"https://api.github.com/repos/kickstarter/rack-attack/issues/123/comments","events_url":"https://api.github.com/repos/kickstarter/rack-attack/issues/123/events","html_url":"https://github.com/kickstarter/rack-attack/issues/123","id":69013364,"number":123,"title":"Ability to add bantime for throttle","user":{"login":"chrisjeon","id":2433941,"avatar_url":"https://avatars.githubusercontent.com/u/2433941?v=3","gravatar_id":"","url":"https://api.github.com/users/chrisjeon","html_url":"https://github.com/chrisjeon","followers_url":"https://api.github.com/users/chrisjeon/followers","following_url":"https://api.github.com/users/chrisjeon/following{/other_user}","gists_url":"https://api.github.com/users/chrisjeon/gists{/gist_id}","starred_url":"https://api.github.com/users/chrisjeon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chrisjeon/subscriptions","organizations_url":"https://api.github.com/users/chrisjeon/orgs","repos_url":"https://api.github.com/users/chrisjeon/repos","events_url":"https://api.github.com/users/chrisjeon/events{/privacy}","received_events_url":"https://api.github.com/users/chrisjeon/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-04-16T21:27:49Z","updated_at":"2015-04-16T23:16:40Z","closed_at":null,"body":"Hello,\r\n\r\nI was wondering if there was a way to add bantime for throttle method.  If not, what is the logic behind refresh rate for throttling?  For example, right now, we have set throttling for ip addresses and set a limit for 10 and period for 10 seconds.  It seems like the throttling works, but rack-attack allows the ip addresses through after a minute or so.  Is there a way to increase this time interval (for example, passing in additional parameters to the throttle method).  If not, what's the logic for setting the time interval between throttling?"},"comment":{"url":"https://api.github.com/repos/kickstarter/rack-attack/issues/comments/93860448","html_url":"https://github.com/kickstarter/rack-attack/issues/123#issuecomment-93860448","issue_url":"https://api.github.com/repos/kickstarter/rack-attack/issues/123","id":93860448,"user":{"login":"zmillman","id":1028921,"avatar_url":"https://avatars.githubusercontent.com/u/1028921?v=3","gravatar_id":"","url":"https://api.github.com/users/zmillman","html_url":"https://github.com/zmillman","followers_url":"https://api.github.com/users/zmillman/followers","following_url":"https://api.github.com/users/zmillman/following{/other_user}","gists_url":"https://api.github.com/users/zmillman/gists{/gist_id}","starred_url":"https://api.github.com/users/zmillman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zmillman/subscriptions","organizations_url":"https://api.github.com/users/zmillman/orgs","repos_url":"https://api.github.com/users/zmillman/repos","events_url":"https://api.github.com/users/zmillman/events{/privacy}","received_events_url":"https://api.github.com/users/zmillman/received_events","type":"User","site_admin":false},"created_at":"2015-04-16T23:16:40Z","updated_at":"2015-04-16T23:16:40Z","body":"Throttling currently resets whenever a throttle period expires. You could set a longer period so that when the limit's exceeded, the IP is locked out for longer:\r\n\r\n```ruby\r\n# 60 requests/minute\r\nthrottle(\"req/ip\", :limit => (10 * 60), :period => (10 * 60).seconds) do |req|\r\n  req.ip\r\nend\r\n```\r\n\r\nYou might also try something like exponential backoff, which you can kind of do with Rack::Attack by layering multiple throttles: https://github.com/kickstarter/rack-attack/issues/106"}}