Download the PHP package genai/rate-limit without Composer
On this page you can find all versions of the php package genai/rate-limit. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download genai/rate-limit
More information about genai/rate-limit
Files in genai/rate-limit
Package rate-limit
Short Description Fixed-window rate limiting. A RateLimiter over a pluggable store (file-backed by default), plus a RateLimitInterceptor that returns 429 when an IP exceeds the limit on a path (brute-force / flood protection). PHP 5.3-safe.
License Apache-2.0
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package rate-limit
genai/rate-limit
Fixed-window rate limiting for the GenAI stack — a small RateLimiter over a
pluggable store, plus a drop-in RateLimitInterceptor that returns 429 when a
client IP exceeds the limit on a path. Brute-force and flood protection without a
line of glue in your controllers. PHP 5.3.29-safe at runtime.
How it counts
A fixed window: time is sliced into window-second buckets; each (key, bucket)
pair has a counter. The interceptor keys on "<ip>|<path>", so every endpoint is
throttled independently — POST /login floods don't burn POST /forgot's budget.
Only state-changing methods (POST/PUT/PATCH/DELETE) are counted, so normal page
browsing (GET) is never throttled.
Use it
-
Configure (
app.ini) — optional; defaults are 20 requests / 60s: -
Expose the limiter as a bean:
-
Enable the interceptor with a thin subclass (it stays opt-in, like CsrfInterceptor):
Scope it to specific paths with
#[Intercept(path: '/login')], or run several subclasses for different endpoints.
Account lockout (failed logins)
RateLimiter is fixed-window flood control. For "lock the account after N wrong
passwords," use AttemptLimiter — it counts failures per key (e.g. an email) and
locks for a fixed duration once the threshold is hit; a success clears it.
lockedFor() returns seconds remaining (0 = open); remaining() gives attempts
left before a lock, for "N tries left" messaging.
Tradeoff: locking by email lets an attacker lock a victim out on purpose by failing 3× against their address. That's inherent to account lockout. If that matters, key on
email|ipinstead — at the cost of letting IP-rotation retry.
Notes
- Client IP comes from
REMOTE_ADDR(not client-spoofable). Behind a trusted reverse proxy, overrideclientIp()to read a vetted forwarded header — never trustX-Forwarded-Forblindly. - FileStore is single-server. Counters are per-
(key, window)files swept opportunistically. For a cluster, implementRateStoreagainst a shared backend (DB / Redis / APCu) and pass it toRateLimiterdirectly. - Fail-open: if the store can't be read/written, requests are allowed — a broken counter never locks users out.
Layers (use any without the others)
RateLimiter+RateStore/FileStore— standalone; no web stack required.RateLimitInterceptor— needsgenai/web(theInterceptorcontract) andgenai/http(the 429Response); both aresuggest, loaded only if you use it.
