marko / ratelimiter

0.11.0 2026-10-06 14:04 UTC

Requires

• php: ^8.5
• marko/cache: 0.11.0
• marko/clock: 0.11.0
• marko/config: 0.11.0
• marko/core: 0.11.0
• marko/routing: 0.11.0

Requires (Dev)

• marko/cache-array: 0.11.0
• marko/cache-redis: 0.11.0
• marko/testing: 0.11.0
• pestphp/pest: ^4.0

MIT

Published on Packagist.org on 2026-10-06 15:41 UTC

README

Cache-backed rate limiter with route middleware --- per-route limits via #[RateLimit], IPv6-safe keys and automatic Retry-After headers.

Installation

composer require marko/ratelimiter

Quick Example

use Marko\RateLimiter\Attributes\RateLimit;
use Marko\RateLimiter\Middleware\RateLimitMiddleware;
use Marko\Routing\Attributes\Middleware;
use Marko\Routing\Attributes\Post;
use Marko\Routing\Http\Response;

class LoginController
{
    #[Post('/login')]
    #[Middleware(RateLimitMiddleware::class)]
    #[RateLimit(maxAttempts: 5, decaySeconds: 60, name: 'login')]
    public function login(): Response
    {
        return new Response('OK');
    }
}

Documentation

Full configuration, middleware usage and API reference: marko/ratelimiter