Table of Contents
RateLimiter
Layer: Core · Source: lib/core/RateLimiter.php:21 (lines 21–219)
class RateLimiter
RateLimiter
File-based sliding window rate limiter for API endpoints. Uses IP address as the default key. Stores request timestamps in per-key files under the cache directory.
Compatible with PHP 7.4+.
Docblock Metadata
| Tag | Value |
|---|---|
@category | Core Class |
@author | Blogware Team |
@license | MIT |
@version | 1.0 |
Inheritance
No parent, interface or trait. This is a root type.
Constants (2)
| Visibility | Name | Value | Line |
|---|---|---|---|
- | DEFAULT_LIMIT | 60; | 26 |
- | DEFAULT_WINDOW | 60; | 31 |
Properties (1)
| Visibility | Type | Name | Default | Line |
|---|---|---|---|---|
private | (untyped) | $cacheDir | 38 |
Methods (8)
| Visibility | Method | Summary | Line |
|---|---|---|---|
| public | __construct() | Constructor | 45 |
| private | ensureCacheDir() | Ensure the cache directory exists and is writable | 56 |
| public | check() | Check if the current request exceeds the rate limit | 72 |
| private | readTimestamps() | Read timestamps from file, filtering out expired ones | 119 |
| private | writeTimestamps() | Write timestamps to file | 148 |
| private | getClientKey() | Generate a unique key for the current client | 167 |
| public | reset() | Reset rate limit for a specific key | 178 |
| public | cleanup() | Clean up expired rate limit files | 196 |
__construct()
public function __construct($cacheDir = null)
lines 45–49 (5)
Constructor
| Parameter | Type | Default | Description |
|---|---|---|---|
$cacheDir | (untyped) | null | Override cache directory path |
ensureCacheDir()
private function ensureCacheDir()
lines 56–61 (6)
Ensure the cache directory exists and is writable
Takes no parameters.
Returns: (none declared) — void
check()
public function check($key = null, $limit = self::DEFAULT_LIMIT, $window = self::DEFAULT_WINDOW, $namespace = '')
lines 72–110 (39)
Check if the current request exceeds the rate limit
| Parameter | Type | Default | Description |
|---|---|---|---|
$key | (untyped) | null | Unique identifier (default: client IP) |
$limit | (untyped) | self::DEFAULT_LIMIT | Maximum requests allowed in the window |
$window | (untyped) | self::DEFAULT_WINDOW | Window size in seconds |
$namespace | (untyped) | '''''' | Optional counter namespace (e.g. 'read' vs 'write') |
Returns: (none declared) — array Result with limit, remaining, reset, retry_after, allowed
readTimestamps()
private function readTimestamps($file, $windowStart)
lines 119–138 (20)
Read timestamps from file, filtering out expired ones
| Parameter | Type | Default | Description |
|---|---|---|---|
$file | (untyped) | required | File path |
$windowStart | (untyped) | required | Earliest valid timestamp |
Returns: (none declared) — array Valid timestamps
writeTimestamps()
private function writeTimestamps($file, $timestamps, $windowStart)
lines 148–155 (8)
Write timestamps to file
| Parameter | Type | Default | Description |
|---|---|---|---|
$file | (untyped) | required | File path |
$timestamps | (untyped) | required | Timestamps to write |
$windowStart | (untyped) | required | Earliest valid timestamp |
Returns: (none declared) — void
getClientKey()
private function getClientKey()
lines 167–170 (4)
Generate a unique key for the current client
Always keys on the client IP address. Previously the bucket key was derived from the attacker-controlled X-API-Key header when present, which let a client pick a fresh bucket per request and bypass the rate limit entirely.
Takes no parameters.
Returns: (none declared) — string
reset()
public function reset($key = null)
lines 178–188 (11)
Reset rate limit for a specific key
| Parameter | Type | Default | Description |
|---|---|---|---|
$key | (untyped) | null | Unique identifier |
Returns: (none declared) — bool
cleanup()
public function cleanup($maxAge = 3600)
lines 196–218 (23)
Clean up expired rate limit files
| Parameter | Type | Default | Description |
|---|---|---|---|
$maxAge | (untyped) | 3600 | Maximum age in seconds before file is considered stale |
Returns: (none declared) — int Number of files cleaned
This page is generated from source by 'tools/gendoc'. Edits will be overwritten.