It allows whitelisting... based on arbitrary properties of the request. So if your user authentication code was also a Rack middleware, and you inserted Rack::

It allows whitelisting... based on arbitrary properties of the request. So if your user authentication code was also a Rack middleware, and you inserted Rack::Attack after it in the middleware stack, you could rate limit based on user account as well as IP address. That would be harder to do at the firewall or web server level. This isn't for preventing DOS attacks (for which you'd want to completely avoid hitting application code), it's just for preventing unauthorised or excessive usage.