DbRateLimit
in package
implements
RateLimit
Fixed-window rate limit over `cms_system_rate_limit`, for hosting without Redis.
hit() is a single INSERT ... ON DUPLICATE KEY UPDATE that creates the row (count 1),
continues the current window (count + 1) or resets the window when it is older than
windowSeconds. Reading the count is a following SELECT, a minor race (an attacker gets
at most one extra hit), acceptable for brute-force protection.
IMPORTANT: fail-open. A DBAL error returns allowed = true, so a storage outage does not
block authentication but also lifts the limit.
Table of Contents
Interfaces
- RateLimit
- Backend for rate limiting and brute-force protection.
Constants
- TABLE : mixed = 'cms_system_rate_limit'
Properties
- $connection : Connection
Methods
- __construct() : mixed
- check() : RateLimitResult
- Reads the current count without incrementing and returns whether the next hit would pass.
- hit() : RateLimitResult
- Records a hit and returns whether it pushed the client over the limit; the count grows.
- purgeOlderThan() : int
- Deletes expired records; called by cron for the DB backend, a no-op for Redis (TTL is managed by `expire`).
- readResult() : RateLimitResult
Constants
TABLE
private
mixed
TABLE
= 'cms_system_rate_limit'
Properties
$connection read-only
private
Connection
$connection
Methods
__construct()
public
__construct(Connection $connection) : mixed
Parameters
- $connection : Connection
check()
Reads the current count without incrementing and returns whether the next hit would pass.
public
check(string $key, int $limit, int $windowSeconds) : RateLimitResult
Use when the limit applies selectively (e.g. login counts only failed attempts: peek before, hit on failure).
Parameters
- $key : string
- $limit : int
- $windowSeconds : int
Return values
RateLimitResulthit()
Records a hit and returns whether it pushed the client over the limit; the count grows.
public
hit(string $key, int $limit, int $windowSeconds) : RateLimitResult
Parameters
- $key : string
-
namespaced key (e.g. 'login:
', 'refresh: ') - $limit : int
-
maximum allowed hits in the window
- $windowSeconds : int
-
window length in seconds
Return values
RateLimitResultpurgeOlderThan()
Deletes expired records; called by cron for the DB backend, a no-op for Redis (TTL is managed by `expire`).
public
purgeOlderThan(int $maxAgeSeconds) : int
Parameters
- $maxAgeSeconds : int
Return values
int —number of deleted rows (-1 on error, 0 for a no-op)
readResult()
private
readResult(string $key, int $limit, int $windowSeconds) : RateLimitResult
Parameters
- $key : string
- $limit : int
- $windowSeconds : int