You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
You can also manage cache using the CLI commands. See [CLI Commands](#cli-commands) section for details.
561
637
562
638
### Custom View Implementations
@@ -674,6 +750,165 @@ Recommendations:
674
750
Run: neuron mvc:cache:clear --expired
675
751
```
676
752
753
+
## Rate Limiting
754
+
755
+
The MVC component includes integrated rate limiting support through the routing component. Rate limiting helps protect your application from abuse and ensures fair resource usage.
756
+
757
+
### Configuration
758
+
759
+
Rate limiting is configured in your `config.yaml` file using two categories:
Configuration maps to environment variables using the `{category}_{name}` pattern:
788
+
- `RATE_LIMIT_ENABLED=true`
789
+
- `RATE_LIMIT_STORAGE=redis`
790
+
- `RATE_LIMIT_REQUESTS=100`
791
+
- `API_LIMIT_ENABLED=true`
792
+
- `API_LIMIT_REQUESTS=1000`
793
+
794
+
### Usage in Routes
795
+
796
+
#### Global Application
797
+
Set `global: true` in configuration to apply rate limiting to all routes:
798
+
```yaml
799
+
rate_limit:
800
+
enabled: true
801
+
global: true
802
+
requests: 100
803
+
window: 3600
804
+
```
805
+
806
+
#### Per-Route Application
807
+
Apply rate limiting to specific routes using the `filter` parameter in `routes.yaml`:
808
+
809
+
```yaml
810
+
routes:
811
+
# Public page - no rate limiting
812
+
- name: home
813
+
method: GET
814
+
route: /
815
+
controller: HomeController@index
816
+
817
+
# Standard protected route with rate limiting
818
+
- name: user_profile
819
+
method: GET
820
+
route: /user/profile
821
+
controller: UserController@profile
822
+
filter: rate_limit # Apply rate_limit (100/hour)
823
+
824
+
# API endpoint with higher limits
825
+
- name: api_users
826
+
method: GET
827
+
route: /api/users
828
+
controller: ApiController@users
829
+
filter: api_limit # Apply api_limit (1000/hour)
830
+
```
831
+
832
+
### Storage Backends
833
+
834
+
#### File Storage (Default)
835
+
Best for single-server deployments:
836
+
```yaml
837
+
rate_limit:
838
+
storage: file
839
+
file_path: cache/rate_limits # Directory for rate limit files
840
+
```
841
+
842
+
#### Redis Storage (Recommended for Production)
843
+
Best for distributed systems and high traffic:
844
+
```yaml
845
+
rate_limit:
846
+
storage: redis
847
+
redis_host: 127.0.0.1
848
+
redis_port: 6379
849
+
redis_database: 0
850
+
redis_prefix: rate_limit_
851
+
redis_auth: password # Optional
852
+
redis_persistent: true # Use persistent connections
853
+
```
854
+
855
+
#### Memory Storage (Testing Only)
856
+
For unit tests and development. Data is lost when PHP process ends:
857
+
```yaml
858
+
rate_limit:
859
+
storage: memory
860
+
```
861
+
862
+
### Rate Limit Headers
863
+
864
+
When rate limiting is active, the following headers are included in responses:
865
+
- `X-RateLimit-Limit`: Maximum requests allowed
866
+
- `X-RateLimit-Remaining`: Requests remaining in current window
867
+
- `X-RateLimit-Reset`: Unix timestamp when limit resets
868
+
869
+
When limit is exceeded (HTTP 429):
870
+
- `Retry-After`: Seconds until retry is allowed
871
+
872
+
### Example Implementation
873
+
874
+
1. Enable rate limiting in `config.yaml`:
875
+
```yaml
876
+
rate_limit:
877
+
enabled: true
878
+
global: false
879
+
storage: redis
880
+
requests: 100
881
+
window: 3600
882
+
redis_host: 127.0.0.1
883
+
884
+
api_limit:
885
+
enabled: true
886
+
storage: redis
887
+
requests: 1000
888
+
window: 3600
889
+
redis_host: 127.0.0.1
890
+
```
891
+
892
+
2. Apply to routes in `routes.yaml`:
893
+
```yaml
894
+
routes:
895
+
- name: login
896
+
method: POST
897
+
route: /auth/login
898
+
controller: AuthController@login
899
+
filter: rate_limit # Strict limit for login attempts
900
+
901
+
- name: api_data
902
+
method: GET
903
+
route: /api/data
904
+
controller: ApiController@getData
905
+
filter: api_limit # Higher limit for API access
906
+
```
907
+
908
+
### Customization
909
+
910
+
For advanced use cases, you can extend the rate limiting system by creating custom filters in your application. The rate limiting system automatically detects if the routing component version supports it and gracefully degrades if not available.
0 commit comments