Bot prevention : IP limit filter

[GoulvenF]

Version française (google translate)

Problem

• Some bot are grabbing us. Ok, that's not a big problem, we are quiet open ;)
• but we have to provide some "bot access control" features, to prevent fronts and backs outages
• we will also need this kind of feature for the B2B API

Solution

• Implement a cool spring filter, that allows a MAX_REQUEST_PER_IP limit, that whitelist known bots, ...
• Will redirect to a captcha protected page (done in Contact page KO : The captcha problem #315 ) to reinit the counter in case when limits are reached

Requisites

• must be a generic and well documented mechanism, to be able to use it easily in new controlers / endpoints that must be bot protected.

• must be configurable, with limits (count and time window)

• must provides a IP whitelisting mechanism , to inject authorized engines ips (bots adress will be handled in a separate service )

• must provides a IP blacklisting mechanism , to inject forbidden engines ips (bots adress will be handled in a separate service )

• should be a spring approach, or something that can easily be applied in spring context

Tips / work tracks

• Can have a look at the commented commons/src/main/java/org/open4goods/filter/QuotasFilter.java, a old legacy implementation of this kind of stuf
• maybe something exists, or could be a new, separate spring boot starter project ?