PHPAML

Documentation · Chapter 08

Slow abuse
without blocking reading.

A rate limit caps similar actions in a time window. It reduces automated noise but does not replace authentication.

We secure reading-list in layers without pretending one option is enough.

Default configuration

phpaml — zsh
"rate_limit": {
  "enabled": true,
  "limit": 60,
  "window": 60,
  "methods": ["POST", "PUT", "PATCH", "DELETE"]
}

The limit applies per client address, HTTP method, and path. GET reads are not limited by default. State is stored under runtime/storage/rate-limits with concurrent-write locking.

When the limit is exceeded

phpaml — zsh
HTTP/1.1 429 Too Many Requests
Retry-After: 37
Content-Type: application/json

{"error":"Trop de requêtes. Réessayez plus tard."}

Retry-After indicates seconds before trying again. An interface should respect this delay instead of immediately repeating the same action.

What rate limiting does not guarantee

  • It does not verify permission to perform the action.
  • One IP address may represent several people.
  • Several servers require shared storage, such as Redis.
  • Thresholds should be tuned from measurements.