Implementing Rate Limiting in PHP

Rate limiting bounds the number or cost of requests over a time window.

What It Does

Rate limiting bounds the number or cost of requests over a time window. The following examples distinguish a normal use case, a boundary case and a practical application.

Requirements and Compatibility

PHP 8.x and a local test environment. Apply input validation, correct error handling and the requirements of any optional libraries.

The code focuses on the core concept. Production implementation may also need routes, validation, persistence, authorization or deployment tooling.

Example 1: Basic Behavior

Track actual per-route request budgets in a shared data store.

<?php
$budget = 100; $used = 97;
echo max(0, $budget - $used); // Remaining requests in the window

Example 2: Another Case

Derive a fixed time window and key, then increment atomically.

<?php
$window = 60; $rate = 20; $now = time();
$windowKey = intdiv($now, $window);
echo "api:limit:" . $windowKey; // Store counters atomically in Redis

Practical Example: Putting It to Use

Return HTTP 429 with bounded Retry-After guidance when a limit is exceeded.

<?php
$limit = 5; $count = 6;
http_response_code($count > $limit ? 429 : 200);
header("Retry-After: 60");
echo http_response_code();

Important Behavior and Edge Cases

Use atomic counters and shared state across workers to avoid bypasses by concurrency.

Comparison with Related Functions or Approaches

Common Beginner Mistakes

Key Takeaways

• Rate limiting bounds the number or cost of requests over a time window.
• Use atomic counters and shared state across workers to avoid bypasses by concurrency.
• Redis Lua scripts or database locks can implement consistent limits.

Before adapting these examples, verify the return values, test the failure paths and confirm that your application meets its security and environment requirements.