{"action":"created","issue":{"url":"https://api.github.com/repos/laravel/framework/issues/16056","repository_url":"https://api.github.com/repos/laravel/framework","labels_url":"https://api.github.com/repos/laravel/framework/issues/16056/labels{/name}","comments_url":"https://api.github.com/repos/laravel/framework/issues/16056/comments","events_url":"https://api.github.com/repos/laravel/framework/issues/16056/events","html_url":"https://github.com/laravel/framework/issues/16056","id":184654547,"number":16056,"title":"Rate Limit doesn't reset after decay","user":{"login":"chargefield","id":13471440,"avatar_url":"https://avatars.githubusercontent.com/u/13471440?v=3","gravatar_id":"","url":"https://api.github.com/users/chargefield","html_url":"https://github.com/chargefield","followers_url":"https://api.github.com/users/chargefield/followers","following_url":"https://api.github.com/users/chargefield/following{/other_user}","gists_url":"https://api.github.com/users/chargefield/gists{/gist_id}","starred_url":"https://api.github.com/users/chargefield/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chargefield/subscriptions","organizations_url":"https://api.github.com/users/chargefield/orgs","repos_url":"https://api.github.com/users/chargefield/repos","events_url":"https://api.github.com/users/chargefield/events{/privacy}","received_events_url":"https://api.github.com/users/chargefield/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-10-22T21:15:46Z","updated_at":"2016-11-05T21:22:32Z","closed_at":null,"body":"- Laravel Version: 5.3.19\n- PHP Version: 7\n- Database Driver & Version: MySQL\n- Cache Driver: Memcached\n### Description:\n\nL5.3.11 to L5.3.19 - Rate limit does not reset after reaching decay. Eventually you get locked out.\nL5.3.10 - Works fine!\n"},"comment":{"url":"https://api.github.com/repos/laravel/framework/issues/comments/258641545","html_url":"https://github.com/laravel/framework/issues/16056#issuecomment-258641545","issue_url":"https://api.github.com/repos/laravel/framework/issues/16056","id":258641545,"user":{"login":"coolynx","id":5902951,"avatar_url":"https://avatars.githubusercontent.com/u/5902951?v=3","gravatar_id":"","url":"https://api.github.com/users/coolynx","html_url":"https://github.com/coolynx","followers_url":"https://api.github.com/users/coolynx/followers","following_url":"https://api.github.com/users/coolynx/following{/other_user}","gists_url":"https://api.github.com/users/coolynx/gists{/gist_id}","starred_url":"https://api.github.com/users/coolynx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coolynx/subscriptions","organizations_url":"https://api.github.com/users/coolynx/orgs","repos_url":"https://api.github.com/users/coolynx/repos","events_url":"https://api.github.com/users/coolynx/events{/privacy}","received_events_url":"https://api.github.com/users/coolynx/received_events","type":"User","site_admin":false},"created_at":"2016-11-05T21:22:32Z","updated_at":"2016-11-05T21:22:32Z","body":"Probably the same issue here.\r\n\r\n- laravel/framework (v5.3.22)\r\n- PHP 7.0.11\r\n- Cache Driver: memcached 1.4.15 (the main issue is here)\r\n\r\nI'm using plain Laravel Passport (without Vue components) for API that uses throttle middleware.\r\n\r\nHere is the story as I understand.\r\n\r\n[Rate limiter](https://github.com/laravel/framework/blob/5.3/src/Illuminate/Cache/RateLimiter.php#L36) puts hits in Cache `$key` and uses it every time it hits the API route. \r\n\r\nWhen it reaches the limit it does two things:\r\n\r\n1. Bans a user for some time - creates a new key `$key:lockout` and gives this key a time to live\r\n2. resets the previous key `$key`\r\n\r\nWhen the wait time, that was set in 1., is over, it checks again and [here it fails](https://github.com/laravel/framework/blob/5.3/src/Illuminate/Cache/RateLimiter.php#L38). 😏 \r\n\r\nA user gets a nice message that in a negative time or in the past she could use this route but unfortunately can not.\r\n\r\n> 23:09:34.094 Server: nginx/1.11.5\r\n> Content-Type: text/html; charset=UTF-8\r\n> Transfer-Encoding: chunked\r\n> Connection: keep-alive\r\n> X-Powered-By: PHP/7.0.11\r\n> Cache-Control: no-cache\r\n> X-RateLimit-Limit: 3\r\n> X-RateLimit-Remaining: 0\r\n> **Retry-After: -1923**\r\n> X-RateLimit-Reset: 1478378251\r\n> phpdebugbar-id: 1fb94283160429e64d94a4b67250af6b\r\n> Date: Sat, 05 Nov 2016 21:09:34 GMT\r\n\r\nThis Cache key `$key:lockout` is still set, time is over and user is banned or blocked.\r\n\r\nHere the story ends. And it never gets cleared. I could not find the place where this key is cleared. I found the [clear()](https://github.com/laravel/framework/blob/5.3/src/Illuminate/Cache/RateLimiter.php#L109) function that could do it, but did not find any place where it is called.\r\n\r\nHere is my solution that does the job.\r\n\r\n```php\r\n    public function tooManyAttempts($key, $maxAttempts, $decayMinutes = 1)\r\n    {\r\n        if ($this->cache->has($key.':lockout')) {\r\n            // check if the time is not negative (not in the past)\r\n            if ($this->availableIn($key) > 0) {\r\n                // continue to fail if it is positive\r\n                return true;\r\n            } else {\r\n                // if the time is passed then clear the locout key\r\n                $this->cache->forget($key.':lockout');\r\n            }\r\n        }\r\n...\r\n```\r\n\r\nIf it is from Vue components or somewhere else, then please - provide some HOWTO. 🙇 "}}
{"actor":{"display_login":"coolynx"}}