Class RateLimitMiddleware
Rate limiting middleware
Provides configurable rate limiting based on various identifiers. Supports multiple strategies including sliding window, token bucket, and fixed window.
Constants
-
IDENTIFIER_API_KEY ¶
'api_key'Identifier type: API key from token headers
-
IDENTIFIER_IP ¶
'ip'Identifier type: client IP address
-
IDENTIFIER_ROUTE ¶
'route'Identifier type: route (controller/action)
-
IDENTIFIER_TOKEN ¶
'token'Identifier type: token (alias for API key)
-
IDENTIFIER_USER ¶
'user'Identifier type: authenticated user
-
STRATEGY_FIXED_WINDOW ¶
'fixed_window'Strategy: fixed window rate limiting
-
STRATEGY_SLIDING_WINDOW ¶
'sliding_window'Strategy: sliding window rate limiting
-
STRATEGY_TOKEN_BUCKET ¶
'token_bucket'Strategy: token bucket rate limiting
Property Summary
-
$config protected
array<string, mixed>Configuration
-
$defaultConfig protected
array<string, mixed>Default configuration
Method Summary
-
__construct() public
Constructor
-
addRateLimitHeaders() protected
Add rate limit headers to response
-
generateKey() protected
Generate cache key for rate limiting
-
getApiKeyIdentifier() protected
Get API key/token identifier
-
getClientIp() protected
Get client IP address
-
getCost() protected
Get the cost of the request
-
getIdentifier() protected
Get the identifier for rate limiting
-
getIdentifierByType() protected
Get identifier by type
-
getLimit() protected
Get rate limit for the request
-
getRateLimiter() protected
Get rate limiter instance based on strategy
-
getRouteIdentifier() protected
Get route identifier
-
getUserIdentifier() protected
Get user identifier
-
process() public
Process the request and add rate limiting
-
resolveLimiterConfig() protected
Resolve limiter configuration for the current request
-
shouldSkip() protected
Check if rate limiting should be skipped for this request
Method Detail
__construct() ¶ public
__construct(array<string, mixed> $config = [])Constructor
Parameters
-
array<string, mixed>$config optional Configuration options
addRateLimitHeaders() ¶ protected
addRateLimitHeaders(Psr\Http\Message\ResponseInterface $response, array<string, mixed> $result): Psr\Http\Message\ResponseInterfaceAdd rate limit headers to response
Parameters
-
Psr\Http\Message\ResponseInterface$response The response
-
array<string, mixed>$result Rate limit result
Returns
Psr\Http\Message\ResponseInterfacegenerateKey() ¶ protected
generateKey(string $identifier, Psr\Http\Message\ServerRequestInterface $request): stringGenerate cache key for rate limiting
Parameters
-
string$identifier The identifier
-
Psr\Http\Message\ServerRequestInterface$request The request
Returns
stringgetApiKeyIdentifier() ¶ protected
getApiKeyIdentifier(Psr\Http\Message\ServerRequestInterface $request): stringGet API key/token identifier
Parameters
-
Psr\Http\Message\ServerRequestInterface$request The request
Returns
stringgetClientIp() ¶ protected
getClientIp(Psr\Http\Message\ServerRequestInterface $request): stringGet client IP address
Parameters
-
Psr\Http\Message\ServerRequestInterface$request The request
Returns
stringgetCost() ¶ protected
getCost(Psr\Http\Message\ServerRequestInterface $request): intGet the cost of the request
Parameters
-
Psr\Http\Message\ServerRequestInterface$request The request
Returns
intgetIdentifier() ¶ protected
getIdentifier(Psr\Http\Message\ServerRequestInterface $request): stringGet the identifier for rate limiting
Parameters
-
Psr\Http\Message\ServerRequestInterface$request The request
Returns
stringgetIdentifierByType() ¶ protected
getIdentifierByType(string $type, Psr\Http\Message\ServerRequestInterface $request): stringGet identifier by type
Parameters
-
string$type The identifier type
-
Psr\Http\Message\ServerRequestInterface$request The request
Returns
stringgetLimit() ¶ protected
getLimit(Psr\Http\Message\ServerRequestInterface $request, string $identifier): intGet rate limit for the request
Parameters
-
Psr\Http\Message\ServerRequestInterface$request The request
-
string$identifier The identifier
Returns
intgetRateLimiter() ¶ protected
getRateLimiter(array<string, mixed> $limiterConfig = []): Cake\Http\RateLimit\RateLimiterInterfaceGet rate limiter instance based on strategy
Parameters
-
array<string, mixed>$limiterConfig optional Optional limiter configuration override
Returns
Cake\Http\RateLimit\RateLimiterInterfacegetRouteIdentifier() ¶ protected
getRouteIdentifier(Psr\Http\Message\ServerRequestInterface $request): stringGet route identifier
Parameters
-
Psr\Http\Message\ServerRequestInterface$request The request
Returns
stringgetUserIdentifier() ¶ protected
getUserIdentifier(Psr\Http\Message\ServerRequestInterface $request): stringGet user identifier
Parameters
-
Psr\Http\Message\ServerRequestInterface$request The request
Returns
stringprocess() ¶ public
process(ServerRequestInterface $request, RequestHandlerInterface $handler): Psr\Http\Message\ResponseInterfaceProcess the request and add rate limiting
Processes an incoming server request in order to produce a response. If unable to produce the response itself, it may delegate to the provided request handler to do so.
Parameters
-
ServerRequestInterface$request The request
-
RequestHandlerInterface$handler The handler
Returns
Psr\Http\Message\ResponseInterfaceresolveLimiterConfig() ¶ protected
resolveLimiterConfig(Psr\Http\Message\ServerRequestInterface $request): array<string, mixed>Resolve limiter configuration for the current request
Parameters
-
Psr\Http\Message\ServerRequestInterface$request The request
Returns
array<string, mixed>shouldSkip() ¶ protected
shouldSkip(Psr\Http\Message\ServerRequestInterface $request): boolCheck if rate limiting should be skipped for this request
Parameters
-
Psr\Http\Message\ServerRequestInterface$request The request
Returns
boolProperty Detail
$defaultConfig ¶ protected
Default configuration
limit: Maximum number of requests allowed (default: 60)window: Time window in seconds for rate limiting (default: 60)identifier: How to identify clients - use IDENTIFIER_* constants (default: IDENTIFIER_IP)strategy: Rate limiting strategy - use STRATEGY_* constants (default: STRATEGY_SLIDING_WINDOW)strategyClass: Fully qualified class name of rate limiter strategy. Takes precedence overstrategyoptioncache: Cache configuration name to use (default: 'default')headers: Whether to add rate limit headers to response (default: true)message: Error message when rate limit is exceededskipCheck: Closure|null to determine if rate limiting should be skipped for a requestcostCallback: Closure|null to calculate custom cost for requests (default: 1 per request)identifierCallback: Closure|null to generate custom identifier, overridesidentifieroptionlimitCallback: Closure|null to determine dynamic limits based on request/identifieripHeader: Header name(s) to check for client IP (default: 'x-forwarded-for')includeRetryAfter: Whether to include Retry-After header (default: true)keyGenerator: Closure|null to generate custom cache keys for rate limitingtokenHeaders: Array of headers to check for API tokens (default: ['Authorization', 'X-API-Key'])limiters: Named limiter configurations for different routes/contextslimiterResolver: Closure|null to resolve which named limiter to use for a request
Type
array<string, mixed>