Rate limiting tweaks

[zwolf]

• Skip POST throttles for users with an admin Role
• Use id from decoded token as key
• Send notification to Honeybadger when Rack::Attack is triggered
• Change general per-IP POST limit to a track: HB will get notified but no throttling

post review:

• Verify JWT via public key to prevent token forgery
• Admins skip throttling

[yuenmichelle1]

I have a couple of questions mostly regarding the change from hashed_token to current_user.

As far as I understand, token authentication for Talk happens in the application controller layer (See: application_controller.rb) and rack attack is middleware that happens before the controller. With current_user in rack_attack.rb not verifying token signature, I think forged tokens might allow attackers to throttle users incorrectly.

But I have not tested, just sniffed weird on a glimpse.

[zwolf]

Forgery is possible enough that adding token verification is a good idea. Added that logic to the initializer. I also added the public key as secrets in the cluster and mounted them as volumes via the deployments.