br-rate-limiting

better-route: rate limiting

Use a fixed-window limiter with an atomic backend. Pick the backend from deployment capabilities; do not silently fall back from an atomic store to a racy read/modify/write.

Persistent object cache

use BetterRoute\Middleware\RateLimit\RateLimitMiddleware;
use BetterRoute\Middleware\RateLimit\WpObjectCacheRateLimiter;

$rateLimit = new RateLimitMiddleware(
    limiter: new WpObjectCacheRateLimiter(group: 'myapp_rate_limit'),
    limit: 60,
    windowSeconds: 60,
);

$router->get('/account', $handler)
    ->protectedByMiddleware('bearerAuth')
    ->middleware([$auth, $rateLimit]);

WpObjectCacheRateLimiter requires:

• WordPress cache functions;
• wp_using_ext_object_cache() === true when that function exists;
• wp_cache_incr();
• a backend whose increment actually behaves atomically.

Construction or a failed increment throws. Use it with a verified Redis/Memcached-style persistent backend, not WordPress's request-local default object cache.

Transient backend

use BetterRoute\Middleware\RateLimit\TransientRateLimiter;

$rateLimit = new RateLimitMiddleware(
    limiter: new TransientRateLimiter(),
    limit: 20,
    windowSeconds: 60,
);

In default WordPress mode, TransientRateLimiter wraps the transient read/modify/write in a MySQL GET_LOCK/RELEASE_LOCK critical section. It requires global $wpdb and may throw when the lock cannot be acquired or state cannot be persisted.

If custom getTransient/setTransient callbacks are injected, also inject a real synchronize callback when requests can run concurrently. Without it, the custom mode executes unsynchronized.

Default key in 1.1

The default key deeply canonicalizes the route and the first available identity:

1. auth middleware user ID;
2. auth subject;
3. explicit context/native logged-in WordPress user ID;
4. HMAC key identity;
5. resolved client IP;
6. guest only when no identity or IP is available.

This means cookie/application-password/native WordPress users get per-user buckets even without an attributes['auth'] entry. Anonymous callers normally get per-IP rather than one global guest bucket.