How can I see what `Rack::Protection` is doing with Sinatra server?
I have a Sinatra server in an AWS environment with a load balancer between the client and the server.
Unless I do something like:
disable: protection
it gives 'Forbidden' on a redirect. I don't want to always disable protection, and I should narrow the amount of disabled protection, so I would like to know what protection is forbidding my redirect.
I am expecting to see something like:
attack prevented by Rack::Protection::<Something>
I have:
enable: logging
and:
-e development
but can't get any feedback from Rack::Protection on why it is applying a rule.
I have tried this:
def self.log_rack_protection(namespace = nil, data = nil)
puts "rack data: #{data.pretty_inspect}"
end
use Rack::Protection, instrumenter: log_rack_protection
but it doesn't seem to be called except on startup.
What do I need to do to get more feedback from Rack::Protection on what module is doing the blocking? Alternatively, is there some configuration we should be applying to the load balancer to stop this protection?
ruby sinatra rack
asked Nov 27 '18 at 6:10
Ross AttrillRoss Attrill
1,50511520
add a comment |
I have a Sinatra server in an AWS environment with a load balancer between the client and the server.
Unless I do something like:
disable: protection
it gives 'Forbidden' on a redirect. I don't want to always disable protection, and I should narrow the amount of disabled protection, so I would like to know what protection is forbidding my redirect.
I am expecting to see something like:
attack prevented by Rack::Protection::<Something>
I have:
enable: logging
and:
-e development
but can't get any feedback from Rack::Protection on why it is applying a rule.
I have tried this:
def self.log_rack_protection(namespace = nil, data = nil)
puts "rack data: #{data.pretty_inspect}"
end
use Rack::Protection, instrumenter: log_rack_protection
but it doesn't seem to be called except on startup.
What do I need to do to get more feedback from Rack::Protection on what module is doing the blocking? Alternatively, is there some configuration we should be applying to the load balancer to stop this protection?
ruby sinatra rack
asked Nov 27 '18 at 6:10
Ross AttrillRoss Attrill
1,50511520
2
There was a similar issue in sidekiq with its Sinatra based web UI. Please see if this thread helps you. Basically, just ensure that you're passing appropriate headers from the reverse proxy (load balancer) to the rack.
– 31piy
Nov 27 '18 at 6:41
1
Thanks @31piy . Based on that reading and some experimentation disabling the 'remote_referrer' protection did the trick. In Sinatra:set :protection, :except => [:remote_referrer]
– Ross Attrill
Nov 28 '18 at 2:58
Its great that you found a way on your own to solve this problem. To help future readers facing similar problem, you should add an answer describing what did you do, and then accept it.
– 31piy
Nov 28 '18 at 3:15
Actually it seemed to beset :protection, :except => [:json_csrf]
– Ross Attrill
Nov 28 '18 at 4:56
add a comment |
I have a Sinatra server in an AWS environment with a load balancer between the client and the server.
Unless I do something like:
disable: protection
it gives 'Forbidden' on a redirect. I don't want to always disable protection, and I should narrow the amount of disabled protection, so I would like to know what protection is forbidding my redirect.
I am expecting to see something like:
attack prevented by Rack::Protection::<Something>
I have:
enable: logging
and:
-e development
but can't get any feedback from Rack::Protection on why it is applying a rule.
I have tried this:
def self.log_rack_protection(namespace = nil, data = nil)
puts "rack data: #{data.pretty_inspect}"
end
use Rack::Protection, instrumenter: log_rack_protection
but it doesn't seem to be called except on startup.
What do I need to do to get more feedback from Rack::Protection on what module is doing the blocking? Alternatively, is there some configuration we should be applying to the load balancer to stop this protection?
ruby sinatra rack
asked Nov 27 '18 at 6:10
Ross AttrillRoss Attrill
1,50511520
I have a Sinatra server in an AWS environment with a load balancer between the client and the server.
Unless I do something like:
disable: protection
it gives 'Forbidden' on a redirect. I don't want to always disable protection, and I should narrow the amount of disabled protection, so I would like to know what protection is forbidding my redirect.
I am expecting to see something like:
attack prevented by Rack::Protection::<Something>
I have:
enable: logging
and:
-e development
but can't get any feedback from Rack::Protection on why it is applying a rule.
I have tried this:
def self.log_rack_protection(namespace = nil, data = nil)
puts "rack data: #{data.pretty_inspect}"
end
use Rack::Protection, instrumenter: log_rack_protection
but it doesn't seem to be called except on startup.
What do I need to do to get more feedback from Rack::Protection on what module is doing the blocking? Alternatively, is there some configuration we should be applying to the load balancer to stop this protection?
ruby sinatra rack
ruby sinatra rack
asked Nov 27 '18 at 6:10
Ross AttrillRoss Attrill
1,50511520
asked Nov 27 '18 at 6:10
Ross AttrillRoss Attrill
1,50511520
edited Nov 28 '18 at 3:03
Ross Attrill
asked Nov 27 '18 at 6:10
Ross AttrillRoss Attrill
1,50511520
asked Nov 27 '18 at 6:10
Ross AttrillRoss Attrill
1,50511520
asked Nov 27 '18 at 6:10
Ross AttrillRoss Attrill
1,50511520
1,50511520
2
There was a similar issue in sidekiq with its Sinatra based web UI. Please see if this thread helps you. Basically, just ensure that you're passing appropriate headers from the reverse proxy (load balancer) to the rack.
– 31piy
Nov 27 '18 at 6:41
1
Thanks @31piy . Based on that reading and some experimentation disabling the 'remote_referrer' protection did the trick. In Sinatra:set :protection, :except => [:remote_referrer]
– Ross Attrill
Nov 28 '18 at 2:58
Its great that you found a way on your own to solve this problem. To help future readers facing similar problem, you should add an answer describing what did you do, and then accept it.
– 31piy
Nov 28 '18 at 3:15
Actually it seemed to beset :protection, :except => [:json_csrf]
– Ross Attrill
Nov 28 '18 at 4:56
add a comment |
2
There was a similar issue in sidekiq with its Sinatra based web UI. Please see if this thread helps you. Basically, just ensure that you're passing appropriate headers from the reverse proxy (load balancer) to the rack.
– 31piy
Nov 27 '18 at 6:41
1
Thanks @31piy . Based on that reading and some experimentation disabling the 'remote_referrer' protection did the trick. In Sinatra:set :protection, :except => [:remote_referrer]
– Ross Attrill
Nov 28 '18 at 2:58
Its great that you found a way on your own to solve this problem. To help future readers facing similar problem, you should add an answer describing what did you do, and then accept it.
– 31piy
Nov 28 '18 at 3:15
Actually it seemed to beset :protection, :except => [:json_csrf]
– Ross Attrill
Nov 28 '18 at 4:56
2
2
There was a similar issue in sidekiq with its Sinatra based web UI. Please see if this thread helps you. Basically, just ensure that you're passing appropriate headers from the reverse proxy (load balancer) to the rack.
– 31piy
Nov 27 '18 at 6:41
There was a similar issue in sidekiq with its Sinatra based web UI. Please see if this thread helps you. Basically, just ensure that you're passing appropriate headers from the reverse proxy (load balancer) to the rack.
– 31piy
Nov 27 '18 at 6:41
1
1
Thanks @31piy . Based on that reading and some experimentation disabling the 'remote_referrer' protection did the trick. In Sinatra:
set :protection, :except => [:remote_referrer]– Ross Attrill
Nov 28 '18 at 2:58
Thanks @31piy . Based on that reading and some experimentation disabling the 'remote_referrer' protection did the trick. In Sinatra:
set :protection, :except => [:remote_referrer]– Ross Attrill
Nov 28 '18 at 2:58
Its great that you found a way on your own to solve this problem. To help future readers facing similar problem, you should add an answer describing what did you do, and then accept it.
– 31piy
Nov 28 '18 at 3:15
Its great that you found a way on your own to solve this problem. To help future readers facing similar problem, you should add an answer describing what did you do, and then accept it.
– 31piy
Nov 28 '18 at 3:15
Actually it seemed to be
set :protection, :except => [:json_csrf]– Ross Attrill
Nov 28 '18 at 4:56
Actually it seemed to be
set :protection, :except => [:json_csrf]– Ross Attrill
Nov 28 '18 at 4:56
add a comment |
1 Answer
1
active
oldest
votes
While I did not work out how to get better logging, I did work out that doing this:
set :protection, :except => [:json_csrf]
stopped the 'Forbidden' message on a client side redirect in the scenario described in the question.
answered Nov 28 '18 at 4:57
Ross AttrillRoss Attrill
1,50511520
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53493717%2fhow-can-i-see-what-rackprotection-is-doing-with-sinatra-server%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
While I did not work out how to get better logging, I did work out that doing this:
set :protection, :except => [:json_csrf]
stopped the 'Forbidden' message on a client side redirect in the scenario described in the question.
answered Nov 28 '18 at 4:57
Ross AttrillRoss Attrill
1,50511520
add a comment |
While I did not work out how to get better logging, I did work out that doing this:
set :protection, :except => [:json_csrf]
stopped the 'Forbidden' message on a client side redirect in the scenario described in the question.
answered Nov 28 '18 at 4:57
Ross AttrillRoss Attrill
1,50511520
add a comment |
While I did not work out how to get better logging, I did work out that doing this:
set :protection, :except => [:json_csrf]
stopped the 'Forbidden' message on a client side redirect in the scenario described in the question.
answered Nov 28 '18 at 4:57
Ross AttrillRoss Attrill
1,50511520
While I did not work out how to get better logging, I did work out that doing this:
set :protection, :except => [:json_csrf]
stopped the 'Forbidden' message on a client side redirect in the scenario described in the question.
answered Nov 28 '18 at 4:57
Ross AttrillRoss Attrill
1,50511520
edited Nov 28 '18 at 5:03
answered Nov 28 '18 at 4:57
Ross AttrillRoss Attrill
1,50511520
answered Nov 28 '18 at 4:57
Ross AttrillRoss Attrill
1,50511520
answered Nov 28 '18 at 4:57
Ross AttrillRoss Attrill
1,50511520
1,50511520
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53493717%2fhow-can-i-see-what-rackprotection-is-doing-with-sinatra-server%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
2
There was a similar issue in sidekiq with its Sinatra based web UI. Please see if this thread helps you. Basically, just ensure that you're passing appropriate headers from the reverse proxy (load balancer) to the rack.
– 31piy
Nov 27 '18 at 6:41
1
Thanks @31piy . Based on that reading and some experimentation disabling the 'remote_referrer' protection did the trick. In Sinatra:
set :protection, :except => [:remote_referrer]– Ross Attrill
Nov 28 '18 at 2:58
Its great that you found a way on your own to solve this problem. To help future readers facing similar problem, you should add an answer describing what did you do, and then accept it.
– 31piy
Nov 28 '18 at 3:15
Actually it seemed to be
set :protection, :except => [:json_csrf]– Ross Attrill
Nov 28 '18 at 4:56