79 lines
2.4 KiB
PHP
79 lines
2.4 KiB
PHP
<?php
|
|
/**
|
|
* Rate Limiting Middleware (File-based, Race-Condition Safe)
|
|
*/
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Middleware;
|
|
|
|
final class RateLimitMiddleware
|
|
{
|
|
/**
|
|
* File-based rate limiter with file-lock to prevent race conditions.
|
|
* For multi-server deployments, replace with Redis.
|
|
*/
|
|
public static function check(int $maxRequests = 60, int $timeWindow = 60): void
|
|
{
|
|
$ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
|
|
$key = 'rl:' . md5($ip);
|
|
|
|
// 1. Try Redis first
|
|
$redis = \App\Core\Cache::getInstance();
|
|
if ($redis) {
|
|
try {
|
|
$count = $redis->get($key);
|
|
if ($count && (int)$count >= $maxRequests) {
|
|
header('Retry-After: ' . $timeWindow);
|
|
json_error('Too Many Requests. Please slow down.', 429);
|
|
}
|
|
|
|
if (!$count) {
|
|
$redis->setex($key, $timeWindow, 1);
|
|
} else {
|
|
$redis->incr($key);
|
|
}
|
|
return; // Success with Redis
|
|
} catch (\Exception $e) {
|
|
// Fallback to file-based if Redis fails
|
|
}
|
|
}
|
|
|
|
// 2. Fallback: File-based rate limiter (original logic)
|
|
$cacheDir = STORAGE_PATH . '/cache';
|
|
$cacheFile = $cacheDir . '/rl_' . md5($ip) . '.json';
|
|
if (!is_dir($cacheDir)) mkdir($cacheDir, 0755, true);
|
|
|
|
$fp = fopen($cacheFile, 'c+');
|
|
if ($fp === false) return;
|
|
|
|
try {
|
|
flock($fp, LOCK_EX);
|
|
$now = time();
|
|
$content = stream_get_contents($fp);
|
|
$requests = [];
|
|
if (!empty($content)) {
|
|
$decoded = json_decode($content, true);
|
|
if (is_array($decoded)) {
|
|
$requests = array_values(array_filter($decoded, fn($ts) => $ts > ($now - $timeWindow)));
|
|
}
|
|
}
|
|
|
|
if (count($requests) >= $maxRequests) {
|
|
flock($fp, LOCK_UN);
|
|
fclose($fp);
|
|
header('Retry-After: ' . $timeWindow);
|
|
json_error('Too Many Requests. Please slow down.', 429);
|
|
}
|
|
|
|
$requests[] = $now;
|
|
ftruncate($fp, 0);
|
|
rewind($fp);
|
|
fwrite($fp, json_encode($requests));
|
|
} finally {
|
|
flock($fp, LOCK_UN);
|
|
fclose($fp);
|
|
}
|
|
}
|
|
}
|