Member-only story
Rate Limiter in Symfony 7
Symfony Rate Limiter — How to implement?

A “rate limiter” regulates how often some activity (i.e., an HTTP call or an auth attempt) is permitted. Rate limiting is often employed as a scandal defense that helps to prevent services from overload (whether deliberate or not). It is also good to regulate internal or outbound flows (for example, the number of messages that are processed at once).
These are the rate limiters that are used by Symfony components such as the login protection mechanism where the number of failed attempts made by the user is limited within a given time period and there many other such usages but you can incorporate these in your own features as well.
What is a Rate Limiter?
A Rate Limiter ensures that a specific resource is not overused. For instance, it can restrict the number of login attempts from a user or IP address within a given time frame. This prevents abuse and improves application security and performance.
There are 3 type of policies for rate limits: Fixed window, Sliding window, Token bucket. Let’s talk about this one by one.
- Fixed Window
This is the simplest technique, based on setting a limit for a specific time interval (e.g., 1,000 requests per hour or 5 login attempts every 30 minutes).