[11.x] Fix the RateLimiter issue when using dynamic keys#53763
Merged
taylorotwell merged 2 commits intoDec 6, 2024
Conversation
165838b to
e11ff7d
Compare
e11ff7d to
4f23c78
Compare
|
@MilesChou Thank you for getting this PR in, was just about to submit one myself as a chunk of an application's unit tests are failing due to this change... <?php
namespace App\RateLimiters;
use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\RateLimiter;
class Web
{
public static function register(): void
{
RateLimiter::for('web', function (Request $request) {
$user = $request->user();
$ip = $request->ip();
return [
Limit::perSecond(5)
->by($user ? $user->id : $ip),
Limit::perMinute(20)
->by($user ? $user->id : $ip),
Limit::perHour(80)
->by($user ? $user->id : $ip),
Limit::perDay(320)
->by($user ? $user->id : $ip),
];
});
}
}test('limited by user id', function () {
$rateLimiter = RateLimiter::limiter('web');
$user = User::factory()->make();
$user->setUniqueIds();
$request = Request::instance();
$request->setUserResolver(fn () => $user);
$limiters = $rateLimiter($request);
dd(collect($limiters)->pluck('key'));
expect($limiters)->toHaveCount(4);
expect($limiters[0]->key)->toEqual($user->id);
});Illuminate\Support\Collectio#2249
#items: array:4 [
0 => "attempts:5:decay:1"
1 => "attempts:20:decay:60"
2 => "attempts:80:decay:3600"
3 => "attempts:320:decay:86400"
]
#escapeWhenCastingToString: false
}@timacdonald Any word on getting this merged? |
Member
|
Sorry about this one, folks. |
browner12
pushed a commit
to browner12/framework
that referenced
this pull request
Dec 10, 2024
* Fix the RateLimite issue when generating dynamic keys * Adjust limit condition in Limit::fallbackKey() method
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In Laravel v11.29.0, a new modification was introduced to the
RateLimitervia PR #53177, which provides a fallback key when no unique key is specified. However, this mechanism can cause issues in scenarios where the key is determined dynamically using a closure.For example, when implementing rate limiting based on dynamic
userIdvalues:In version 11.29.0, the
Limit::by($userId)method is ignored, and the fallback key is used instead, causing rate limiting records for differentuserIdvalues to interfere with each other.This fix ensures that if the original limit has a recorded key, it uses the original key as a prefix. For more details, please refer to the PR.