PHPackages                             genai/rate-limit - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. genai/rate-limit

ActiveLibrary[Security](/categories/security)

genai/rate-limit
================

Fixed-window rate limiting. A RateLimiter over a pluggable store (file-backed by default), plus a RateLimitInterceptor that returns 429 when an IP exceeds the limit on a path (brute-force / flood protection). PHP 5.3-safe.

v1.0.1(1mo ago)079↓52.1%Apache-2.0PHPPHP >=5.3.0CI passing

Since Jul 3Pushed 1mo agoCompare

[ Source](https://github.com/GenAIIO/php-rate-limit)[ Packagist](https://packagist.org/packages/genai/rate-limit)[ RSS](/packages/genai-rate-limit/feed)WikiDiscussions main Synced 1w ago

READMEChangelog (1)Dependencies (1)Versions (3)Used By (0)

genai/rate-limit
================

[](#genairate-limit)

Fixed-window rate limiting for the GenAI stack — a small `RateLimiter` over a pluggable store, plus a drop-in `RateLimitInterceptor` that returns **429** when a client IP exceeds the limit on a path. Brute-force and flood protection without a line of glue in your controllers. PHP 5.3.29-safe at runtime.

How it counts
-------------

[](#how-it-counts)

A fixed window: time is sliced into `window`-second buckets; each `(key, bucket)`pair has a counter. The interceptor keys on `"|"`, so every endpoint is throttled independently — `POST /login` floods don't burn `POST /forgot`'s budget. Only state-changing methods (POST/PUT/PATCH/DELETE) are counted, so normal page browsing (GET) is never throttled.

Use it
------

[](#use-it)

1. Configure (`app.ini`) — optional; defaults are 20 requests / 60s:

    ```
    [ratelimit]
    limit  = 20
    window = 60
    path   = cache/ratelimit
    ```
2. Expose the limiter as a bean:

    ```
    #[Configuration]
    class RateLimitConfig {
        #[Bean(RateLimiter::class)]
        public function rateLimiter(RateLimitProperty $cfg) {
            return RateLimitFactory::build($cfg);
        }
    }
    ```
3. Enable the interceptor with a thin subclass (it stays opt-in, like CsrfInterceptor):

    ```
    #[Intercept]   // all requests; only POST-likes are counted
    class Throttle extends \GenAI\RateLimit\Interceptor\RateLimitInterceptor {}
    ```

    Scope it to specific paths with `#[Intercept(path: '/login')]`, or run several subclasses for different endpoints.

Account lockout (failed logins)
-------------------------------

[](#account-lockout-failed-logins)

`RateLimiter` is fixed-window flood control. For "lock the account after N wrong passwords," use `AttemptLimiter` — it counts *failures* per key (e.g. an email) and locks for a fixed duration once the threshold is hit; a success clears it.

```
#[Bean(AttemptLimiter::class)]
public function loginLockout(RateLimitProperty $cfg) {
    return RateLimitFactory::lockout($cfg);   // [ratelimit] login_max_fails / login_lock
}
```

```
if (($wait = $lockout->lockedFor($email)) > 0) {
    return "locked — try again in ~" . ceil($wait / 60) . " min";
}
if ($passwordOk) { $lockout->clear($email); }   // reset on success
else             { $lockout->fail($email);  }    // count the failure
```

`lockedFor()` returns seconds remaining (0 = open); `remaining()` gives attempts left before a lock, for "N tries left" messaging.

> **Tradeoff:** locking by email lets an attacker lock a victim out on purpose by failing 3× against their address. That's inherent to account lockout. If that matters, key on `email|ip` instead — at the cost of letting IP-rotation retry.

Notes
-----

[](#notes)

- **Client IP** comes from `REMOTE_ADDR` (not client-spoofable). Behind a trusted reverse proxy, override `clientIp()` to read a *vetted* forwarded header — never trust `X-Forwarded-For` blindly.
- **FileStore** is single-server. Counters are per-`(key, window)` files swept opportunistically. For a cluster, implement `RateStore` against a shared backend (DB / Redis / APCu) and pass it to `RateLimiter` directly.
- **Fail-open**: if the store can't be read/written, requests are allowed — a broken counter never locks users out.

Layers (use any without the others)
-----------------------------------

[](#layers-use-any-without-the-others)

- `RateLimiter` + `RateStore`/`FileStore` — standalone; no web stack required.
- `RateLimitInterceptor` — needs `genai/web` (the `Interceptor` contract) and `genai/http` (the 429 `Response`); both are `suggest`, loaded only if you use it.

###  Health Score

36

—

LowBetter than 79% of packages

Maintenance90

Actively maintained with recent releases

Popularity12

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity30

Early-stage or recently created project

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~6 days

Total

2

Last Release

47d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/25e5bd31b5dd70d47cbdc738bded06dbabfba3d584acce63c2c4b4fb7847f39d?d=identicon)[jinnguyen](/maintainers/jinnguyen)

---

Top Contributors

[![linhnnmt](https://avatars.githubusercontent.com/u/162856460?v=4)](https://github.com/linhnnmt "linhnnmt (7 commits)")

### Embed Badge

![Health badge](/badges/genai-rate-limit/health.svg)

```
[![Health](https://phpackages.com/badges/genai-rate-limit/health.svg)](https://phpackages.com/packages/genai-rate-limit)
```

###  Alternatives

[paragonie/ecc

PHP Elliptic Curve Cryptography library

24866.3k44](/packages/paragonie-ecc)[sansec/magento2-module-shield

15218.6k](/packages/sansec-magento2-module-shield)[nicobleiler/php-passphrase

Passphrase generator with Laravel integration, inspired by Bitwarden. Uses the EFF long word list by default with support for custom wordlists.

4912.6k](/packages/nicobleiler-php-passphrase)[dwgebler/encryption

Encryption wrapper for PHP using libsodium — simple API for symmetric and asymmetric encryption, password hashing, digital signing, and message authentication.

317.5k](/packages/dwgebler-encryption)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)