节流时间问题

Question

我trait ThrottlesLogins在Laravel 5.5中添加了以下方法

protected function TotalRegisterAttemptsLeft($request) {
    $this->incrementAttempts($request);
    return $this->limiter()->retriesLeft($this->resolveRequestSignature($request), 3);
}

路线

Route::post('apiregister', 
    array(
        'uses'          =>  'API\Register\RegisterAPIController@Registration', 
        'as'            =>  'apiRegister',
        'middleware'    =>  'throttle:3,1'
    )
);

这种方法在5.4中完美运行,让我解释一下这个问题.

我有一个注册POST路由,最多3次尝试.使用所有三次尝试后,用户必须等待60秒.

但问题是,假设我在三次尝试中花了12秒钟.经过3次尝试,它说,请在48秒后尝试.应该说,请在60秒后再试一次.

如果您需要更多详细信息,请与我们联系.

Answer 1

这可能是ThrottleRequests-Middleware中的错误或预期行为.更改现有集成测试时,您可以轻松地重现这一点:

public function test_lock_opens_immediately_after_decay()
{
    Carbon::setTestNow(null);

    Route::get('/', function () {
        return 'yes';
    })->middleware(ThrottleRequests::class.':2,1');

    $response = $this->withoutExceptionHandling()->get('/');
    $this->assertEquals('yes', $response->getContent());
    $this->assertEquals(2, $response->headers->get('X-RateLimit-Limit'));
    $this->assertEquals(1, $response->headers->get('X-RateLimit-Remaining'));

    Carbon::setTestNow(
        Carbon::now()->addSeconds(10)
    );

    $response = $this->withoutExceptionHandling()->get('/');
    $this->assertEquals('yes', $response->getContent());
    $this->assertEquals(2, $response->headers->get('X-RateLimit-Limit'));
    $this->assertEquals(0, $response->headers->get('X-RateLimit-Remaining'));

    Carbon::setTestNow(
        Carbon::now()->addSeconds(58)
    );

    try {
        $this->withoutExceptionHandling()->get('/');
    } catch (Throwable $e) {
        $this->assertEquals(429, $e->getStatusCode());
        $this->assertEquals(2, $e->getHeaders()['X-RateLimit-Limit']);
        $this->assertEquals(0, $e->getHeaders()['X-RateLimit-Remaining']);
        $this->assertEquals(2, $e->getHeaders()['Retry-After']);
        $this->assertEquals(Carbon::now()->addSeconds(2)->getTimestamp(), $e->getHeaders()['X-RateLimit-Reset']);
    }
}

我刚才补充道

Carbon::setTestNow(
    Carbon::now()->addSeconds(10)
);

在第一个和第二个请求之间.这将导致phpunit的以下输出:

./vendor/bin/phpunit tests/Integration/Http/ThrottleRequestsTest.php
PHPUnit 6.5.5 by Sebastian Bergmann and contributors.

Runtime:       PHP 7.2.1
Configuration: /Volumes/Workspace/Projects/laravel/phpunit.xml.dist

F                                                                   1 / 1 (100%)

Time: 172 ms, Memory: 10.00MB

There was 1 failure:

1) Illuminate\Tests\Integration\Http\ThrottleRequestsTest::test_lock_opens_immediately_after_decay
Failed asserting that -8 matches expected 2.

/Volumes/Workspace/Projects/laravel/tests/Integration/Http/ThrottleRequestsTest.php:54

我已经用失败的测试创建了一个PR~一旦确认这不是预期的行为,有人可以开始修复它:〜 

https://github.com/laravel/framework/pull/22725/files

编辑:如PR中所述,这是预期的行为.中间件专为API速率限制而设计,您希望确保在特定时间范围内x量的请求通过.要限制密码尝试,您必须切换基础RateLimiter.

至于为何之前有效,我不能告诉你.