[RateLimiter] [WIP] add attribute for controllers methods #59920

RazielRodrigues · Mar 5, 2025

Q	A
Branch?	7.3
Bug fix?	no
New feature?	yes
Deprecations?	no
Issues	Fix #52518
License	MIT

carsonbot · Mar 5, 2025

Hey!

I see that this is your first PR. That is great! Welcome!

Symfony has a contribution guide which I suggest you to read.

In short:

Always add tests
Keep backward compatibility (see https://symfony.com/bc).
Bug fixes must be submitted against the lowest maintained branch where they apply (see https://symfony.com/releases)
Features and deprecations must be submitted against the 7.3 branch.

Review the GitHub status checks of your pull request and try to solve the reported issues. If some tests are failing, try to see if they are failing because of this change.

When two Symfony core team members approve this change, it will be merged and you will become an official Symfony contributor!
If this PR is merged in a lower version branch, it will be merged up to all maintained branches within a few days.

I am going to sit back now and wait for the reviews.

Cheers!

Carsonbot

alexandre-daubois · Mar 6, 2025

Hello, first of all thank you for your interest in contributing to Symfony!

It seems the PR is incomplete. The new attribute is indeed created, but it lacks the mechanism to register it and actually rate limit methods, right?

kbond

Hey @RazielRodrigues, thanks for getting this started!

This will work very similar to IsGranted and IsGrantedAttributeListener so check out the code around these.

kbond · Mar 6, 2025

src/Symfony/Component/RateLimiter/Attribute/RateLimitAttribute.php

+ * @author Raziel Rodrigues <raziel.rodrigues@outlook.pt>
+ */
+#[\Attribute(\Attribute::IS_REPEATABLE | \Attribute::TARGET_METHOD)]
+final class RateLimit


You'll need to rename this file to match the class name: RateLimit.php

kbond · Mar 6, 2025

src/Symfony/Component/RateLimiter/Attribute/RateLimitAttribute.php

+     */
+    public function __construct(
+        public string $limiter,
+        public array $methods


Suggested change

public array $methods

public array $methods = [],

My thinking is: [] === all methods (the default)

kbond · Mar 6, 2025

src/Symfony/Component/RateLimiter/Attribute/RateLimitAttribute.php

+     * @param string $limiter The name of the limiter to use
+     * @param array $methods Methods to apply the rate limit


Suggested change

* @param string $limiter The name of the limiter to use

* @param array $methods Methods to apply the rate limit

* @param string $limiter The configured limiter name

* @param string[] $methods Request methods to apply the rate limit (`[]` for all)

kbond · Mar 6, 2025

src/Symfony/Component/RateLimiter/Attribute/RateLimitAttribute.php

+namespace Symfony\Component\RateLimiter\Attribute;
+
+/**
+ * Add the hability to rate limit a method from a controller


Suggested change

* Add the hability to rate limit a method from a controller

* Rate limit the controller.

yceruto · Mar 6, 2025

Question: should the #[RateLimit] attribute point to an implementation of RequestRateLimiterInterface? From the linked proposal, it looks like it's referencing the factory configuration, which seems incorrect.

kbond · Mar 6, 2025

Question: should the #[RateLimit] attribute point to an implementation of RequestRateLimiterInterface?

I'd actually forgotten about RequestRateLimiterInterface. My thinking of this features was indeed: #RateLimit('name') would use the configured rate limiter factory name. By default, the limiter would be created for a key with url, method, client ip. This could be customized with an expression - maybe even having the user available?

#[RateLimit('my_limiter', key: 'url~method~request.getClientIp()~user?.getUsername()')

But now, remembering the RequestRateLimiterInterface, I wonder if it could be leveraged...

RazielRodrigues · Mar 18, 2025

Question: should the #[RateLimit] attribute point to an implementation of RequestRateLimiterInterface?

I'd actually forgotten about RequestRateLimiterInterface. My thinking of this features was indeed: #RateLimit('name') would use the configured rate limiter factory name. By default, the limiter would be created for a key with url, method, client ip. This could be customized with an expression - maybe even having the user available?
#[RateLimit('my_limiter', key: 'url~method~request.getClientIp()~user?.getUsername()')
But now, remembering the RequestRateLimiterInterface, I wonder if it could be leveraged...

Thanks for all the comments guys, I will work on this MR this week, I was a bit busy but now I am totally free to work on this merge request, ASAP I will commit the changes

RazielRodrigues · May 13, 2025

Hello, first of all thank you for your interest in contributing to Symfony!

It seems the PR is incomplete. The new attribute is indeed created, but it lacks the mechanism to register it and actually rate limit methods, right?

Hi do you know how can I test the stuff I have done? Because I implemented the event and so on but now I need to test it and I don't know how

feat: creating rate limiter attribute

00a59a3

carsonbot added Status: Needs Review Feature RateLimiter labels Mar 5, 2025

carsonbot added this to the 7.3 milestone Mar 5, 2025

This comment was marked as resolved.

Sign in to view

RazielRodrigues mentioned this pull request Mar 5, 2025

[RateLimiter] controller attribute #52518

Open

kbond reviewed Mar 6, 2025

View reviewed changes

kbond changed the title ~~[RateLimiter] add attribute for controllers methods~~ [WIP][RateLimiter] add attribute for controllers methods Mar 6, 2025

kbond changed the title ~~[WIP][RateLimiter] add attribute for controllers methods~~ [RateLimiter] [WIP] add attribute for controllers methods Mar 6, 2025

RazielRodrigues added 3 commits May 12, 2025 23:16

feat: creating rate limiter attribute

6b0c5a9

refactor: changing the name of file

67316e3

feat: adding the rate limit attribute listener

279217d

refactor: removing usused code

dd2dc8e

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[RateLimiter] [WIP] add attribute for controllers methods #59920

[RateLimiter] [WIP] add attribute for controllers methods #59920

RazielRodrigues commented Mar 5, 2025 •

edited by kbond

Loading

carsonbot commented Mar 5, 2025

This comment was marked as resolved.

alexandre-daubois commented Mar 6, 2025

kbond left a comment •

edited

Loading

kbond Mar 6, 2025

RazielRodrigues May 13, 2025

kbond Mar 6, 2025

kbond Mar 6, 2025 •

edited

Loading

kbond Mar 6, 2025

yceruto commented Mar 6, 2025

kbond commented Mar 6, 2025 •

edited

Loading

RazielRodrigues commented Mar 18, 2025

RazielRodrigues commented May 13, 2025

		* @param string $limiter The name of the limiter to use
		* @param array $methods Methods to apply the rate limit

	* Add the hability to rate limit a method from a controller
	* Rate limit the controller.

Search code, repositories, users, issues, pull requests...

[RateLimiter] [WIP] add attribute for controllers methods #59920

Are you sure you want to change the base?

[RateLimiter] [WIP] add attribute for controllers methods #59920

Conversation

RazielRodrigues commented Mar 5, 2025 • edited by kbond Loading

carsonbot commented Mar 5, 2025

This comment was marked as resolved.

alexandre-daubois commented Mar 6, 2025

kbond left a comment • edited Loading

Choose a reason for hiding this comment

kbond Mar 6, 2025

Choose a reason for hiding this comment

RazielRodrigues May 13, 2025

Choose a reason for hiding this comment

kbond Mar 6, 2025

Choose a reason for hiding this comment

kbond Mar 6, 2025 • edited Loading

Choose a reason for hiding this comment

kbond Mar 6, 2025

Choose a reason for hiding this comment

yceruto commented Mar 6, 2025

kbond commented Mar 6, 2025 • edited Loading

RazielRodrigues commented Mar 18, 2025

RazielRodrigues commented May 13, 2025

RazielRodrigues commented Mar 5, 2025 •

edited by kbond

Loading

kbond left a comment •

edited

Loading

kbond Mar 6, 2025 •

edited

Loading

kbond commented Mar 6, 2025 •

edited

Loading