RedisRateLimit
in package
implements
RateLimit
Sliding-window log over a Redis sorted set.
Every hit adds an entry scored by microtime, expired entries are removed by
ZREMRANGEBYSCORE and the count comes from ZCARD. More precise than a fixed window (no
boundary burst at the start of a new window), at the cost of O(N) memory per unique key.
IMPORTANT: fail-open. A missing Predis or a Redis exception returns allowed = true, so a
Redis outage does not block authentication but also lifts the limit.
Table of Contents
Interfaces
- RateLimit
- Backend for rate limiting and brute-force protection.
Constants
- KEY_PREFIX : mixed = 'ratelimit:'
Properties
- $redis : Client|null
Methods
- __construct() : mixed
- check() : RateLimitResult
- Reads the current count without incrementing and returns whether the next hit would pass.
- hit() : RateLimitResult
- Records a hit and returns whether it pushed the client over the limit; the count grows.
- purgeOlderThan() : int
- Deletes expired records; called by cron for the DB backend, a no-op for Redis (TTL is managed by `expire`).
- buildResult() : RateLimitResult
Constants
KEY_PREFIX
private
mixed
KEY_PREFIX
= 'ratelimit:'
Properties
$redis read-only
private
Client|null
$redis
= null
Methods
__construct()
public
__construct([Client|null $redis = null ]) : mixed
Parameters
- $redis : Client|null = null
check()
Reads the current count without incrementing and returns whether the next hit would pass.
public
check(string $key, int $limit, int $windowSeconds) : RateLimitResult
Use when the limit applies selectively (e.g. login counts only failed attempts: peek before, hit on failure).
Parameters
- $key : string
- $limit : int
- $windowSeconds : int
Return values
RateLimitResulthit()
Records a hit and returns whether it pushed the client over the limit; the count grows.
public
hit(string $key, int $limit, int $windowSeconds) : RateLimitResult
Parameters
- $key : string
-
namespaced key (e.g. 'login:
', 'refresh: ') - $limit : int
-
maximum allowed hits in the window
- $windowSeconds : int
-
window length in seconds
Return values
RateLimitResultpurgeOlderThan()
Deletes expired records; called by cron for the DB backend, a no-op for Redis (TTL is managed by `expire`).
public
purgeOlderThan(int $maxAgeSeconds) : int
Parameters
- $maxAgeSeconds : int
Return values
int —number of deleted rows (-1 on error, 0 for a no-op)
buildResult()
private
buildResult(int $count, int $limit, int $windowSeconds) : RateLimitResult
Parameters
- $count : int
- $limit : int
- $windowSeconds : int