quioteframework/ratelimit

Rate limiting (login throttle, PDO-backed limiter storage) for Quiote, built on symfony/rate-limiter.

v3.0.1 2026-07-28 17:49 UTC

Requires

• php: >=8.5.0
• ext-pdo: *
• quioteframework/quiote: *
• symfony/cache: ^8.0
• symfony/rate-limiter: ^8.0

MIT

• Quiote Contributors

• security
• rate-limiting
• quiote

Published on Packagist.org on 2026-07-29 12:45 UTC

README

Rate limiting (login throttle, PDO-backed limiter storage) for Quiote, built on symfony/rate-limiter.

Install

composer require quioteframework/ratelimit

Use as a plain library (login throttle)

No plugins config entry needed. Instantiate directly where you need it:

use Quiote\Security\RateLimit\LoginThrottle;
use Quiote\Security\RateLimit\PdoRateLimiterStorage;

$throttle = new LoginThrottle(new PdoRateLimiterStorage($pdo));

General HTTP rate limiting (middleware)

RateLimitMiddleware throttles requests per client IP. It's registered by RateLimitPlugin and opt-in via ratelimit.http.enabled:

• ratelimit.http.enabled — default false
• ratelimit.http.max_requests — default 60
• ratelimit.http.window — default "1 minute"
• ratelimit.http.policy — sliding_window / fixed_window / token_bucket, default sliding_window
• ratelimit.http.trust_forwarded_for — trust X-Forwarded-For for the client key instead of REMOTE_ADDR, default false (only enable behind a trusted reverse proxy)

Limiter state defaults to an in-memory store (Symfony\Component\RateLimiter\Storage\InMemoryStorage, reset every process/worker restart). Set ratelimit.storage to redis for state shared across workers and processes via a Redis connection (ratelimit.redis.dsn, default redis://127.0.0.1:6379) — requires a Redis client (predis/predis, ext-redis, or ext-relay). Bind PdoRateLimiterStorage as the Symfony\Component\RateLimiter\Storage\StorageInterface service instead for state shared without a Redis dependency. An over-limit request gets a 429 application/problem+json response with a Retry-After header.

License

MIT. See LICENSE.