finding: Front/Api rate limiting overlaps with core/php-api #4

New issue

Open

opened 2026-02-21 00:16:12 +00:00 by Clotho · 0 comments

Clotho commented

2026-02-21 00:16:12 +00:00

Member

Overlap

src/Core/Front/Api/Boot.php registers a general-purpose rate limiter for the api middleware group:

RateLimiter::for('api', function (Request $request) {
    return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip());
});

core/php-api (host-uk/core-api) adds its own RateLimitApi middleware that applies API-key-specific rate limiting (src/Api/Middleware/RateLimitApi.php).

What Differs

Front/Api: Generic per-user/IP limit (60 req/min), no API key awareness
core/php-api RateLimitApi: Per-API-key limit, configurable per key tier

Risk

Both rate limiters apply to the same api middleware group. A request may be rate-limited twice, or the core/php-api middleware may silently replace the framework default without documentation.

Recommendation

Keep separate but document the interaction. The framework’s limiter acts as a final backstop for unauthenticated/guest traffic. core/php-api’s limiter handles authenticated API key traffic. Consider making the framework limiter configurable (or a no-op when core/php-api is installed) to avoid confusion.

Closes #3

## Overlap `src/Core/Front/Api/Boot.php` registers a general-purpose rate limiter for the `api` middleware group: ```php RateLimiter::for('api', function (Request $request) { return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip()); }); ``` `core/php-api` (`host-uk/core-api`) adds its own `RateLimitApi` middleware that applies API-key-specific rate limiting (`src/Api/Middleware/RateLimitApi.php`). ## What Differs - **Front/Api**: Generic per-user/IP limit (60 req/min), no API key awareness - **core/php-api `RateLimitApi`**: Per-API-key limit, configurable per key tier ## Risk Both rate limiters apply to the same `api` middleware group. A request may be rate-limited twice, or the `core/php-api` middleware may silently replace the framework default without documentation. ## Recommendation **Keep separate but document the interaction.** The framework’s limiter acts as a final backstop for unauthenticated/guest traffic. `core/php-api`’s limiter handles authenticated API key traffic. Consider making the framework limiter configurable (or a no-op when `core/php-api` is installed) to avoid confusion. Closes #3