Rate Limiter

[plexmaniax]

Q	A
Bug report?	no
Feature request?	yes
BC Break report?	no
RFC?	no

It would be nice to prevent Spam attacks in formbuilder. Maybe it is possible to limit the possibility of sending forms per ip and duration. So bots can't send forms every second 'til someone disabled the form.

[solverat]

A ratelimiter in PHP land is pretty useless against DDoS. The common practice is stuffing attacks trough thousands of proxies. Ratelimiting does not help against that.

I quote:

By definition, the Symfony rate limiters require Symfony to be booted in a PHP process. This makes them not useful to protect against DoS attacks. Such protections must consume the least resources possible. Consider using Apache mod_ratelimit, NGINX rate limiting, Caddy HTTP rate limit module (also supported by FrankenPHP) or proxies (like AWS or Cloudflare) to prevent your server from being overwhelmed.