search

mevdschee / php-crud-api

Single file PHP script that adds a REST API to a SQL database
MIT License
3.58k stars 1.01k forks source link

Add rate limit functionality #286

Open mhajder opened 7 years ago

mhajder commented 7 years ago

Hi, Can I use rate limit with php-crud-api? And how can I create this rate limit.

mevdschee commented 7 years ago

No, that is not (yet) supported.

You can run the script behind Kong. See: https://getkong.org/

mhajder commented 7 years ago

Is there something for shared hosting?

mevdschee commented 7 years ago

@Rzeszow do you have memcache available? You need some store and should preferably not be the database or disk (for performance reasons).

mhajder commented 7 years ago

Yes i have.

mevdschee commented 7 years ago

You can do something like described here:

https://www.leaseweb.com/labs/2015/06/limit-concurrent-php-requests-using-memcache/

mhajder commented 7 years ago

Thanks

mevdschee commented 5 years ago

Some Design ideas:

If you exceed the provided rate limit for a given endpoint, you will receive the 429 Too Many Requests response

Rate limits should allow filtering of concurrent requests per ip address.

Rate limits should allow a bucket per "concurrent", "minute", "hour" and/or "day"

mevdschee commented 3 years ago

Rate limit scopes should be "per authenticated session" (a specific session key), or "per ip address"

Rate limits may have different buckets for different endpoints.

Rate limits may set 'X-Rate-Limit' headers, see: https://tools.ietf.org/id/draft-polli-ratelimit-headers-00.html#rfc.section.3.1

mevdschee commented 3 years ago

We could count query/server time and limit the quota to x milliseconds execution time per hour, to make the quota fairer.

mevdschee commented 3 years ago

rate limiter should error with: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/429

maybe a 'Retry-After' header (seems similar to X-Rate-Limit-Reset)