Lightweight PHP Rate Limiter Middleware

PSR-15 middleware for rate limiting requests per client IP address (or per user id) using a fixed-window counter backed by a PSR-6 cache pool.

It is framework agnostic and works with any PSR-15 stack (Slim 4, Mezzio, Laminas, ...).

Installation

composer require antoninom90/php-rate-limiter-middleware

Usage

use Antoninom90\RateLimiter\RateLimitMiddleware;
use Psr\Cache\CacheItemPoolInterface;
use Psr\Http\Message\ResponseFactoryInterface;

$app->add(new RateLimitMiddleware(
    $container->get(CacheItemPoolInterface::class),  // any PSR-6 pool
    $container->get(ResponseFactoryInterface::class),
    60,   // limit:  maximum requests per window
    60    // window: window size in seconds
));

How it works

• every request counts against the current fixed window;
• the requestor key is the client IP address (REMOTE_ADDR, or the ip_address request attribute when set by an outer middleware);
• if the request carries a user id (the user_id request attribute or the user_id session key), the limit applies to that user instead of the IP;
• allowed responses carry X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers;
• once the limit is reached the client receives a 429 Too Many Requests JSON response with a Retry-After header;
• counters expire at the end of each window.

Example with Symfony Cache (Slim 4)

use Antoninom90\RateLimiter\RateLimitMiddleware;
use Psr\Cache\CacheItemPoolInterface;
use Slim\App;
use Slim\Psr7\Factory\ResponseFactory;
use Symfony\Component\Cache\Adapter\FilesystemAdapter;

$cachePool = new FilesystemAdapter('rate_limit', 0, __DIR__ . '/var/cache/rate_limit');

$app = AppFactory::create();

$app->add(new RateLimitMiddleware(
    $cachePool,
    new ResponseFactory(),
    60,
    60
));

Requirements

• PHP ^8.1
• psr/cache ^3.0, psr/http-factory ^1.0, psr/http-message ^1.1|^2.0, psr/http-server-middleware ^1.0

License

The MIT License (MIT). Please see LICENSE for more information.