This is the better way. The redirection happens inside the server. Rack Attack runs early in the request processing and says "do the rest of the processing as i

This is the better way. The redirection happens inside the server. Rack Attack runs early in the request processing and says "do the rest of the processing as if the client's request were for a page that does not exist", then the server acts accordingly.