Question

我在Laravel 5.5中的trait ThrottlesLogins中添加了以下方法

protected function TotalRegisterAttemptsLeft($request) {
    $this->incrementAttempts($request);
    return $this->limiter()->retriesLeft($this->resolveRequestSignature($request), 3);
}

路线

Route::post('apiregister', 
    array(
        'uses'          =>  'API\Register\RegisterAPIController@Registration', 
        'as'            =>  'apiRegister',
        'middleware'    =>  'throttle:3,1'
    )
);

这种方法在5.4中完美运行，让我解释一下这个问题。

我有一个注册POST路由，最多尝试3次。使用所有三次尝试后，用户必须等待60秒。

但问题是，假设我在三次尝试中花费了12秒。经过3次尝试，它说，请在48秒后尝试。应该说，请在60秒后再试一次。

如果您需要更多详细信息，请与我们联系。

Answer 1

这是ThrottleRequests-Middleware中的错误或预期行为。更改现有的集成测试时，您可以轻松地重现这一点：

public function test_lock_opens_immediately_after_decay()
{
    Carbon::setTestNow(null);

    Route::get('/', function () {
        return 'yes';
    })->middleware(ThrottleRequests::class.':2,1');

    $response = $this->withoutExceptionHandling()->get('/');
    $this->assertEquals('yes', $response->getContent());
    $this->assertEquals(2, $response->headers->get('X-RateLimit-Limit'));
    $this->assertEquals(1, $response->headers->get('X-RateLimit-Remaining'));

    Carbon::setTestNow(
        Carbon::now()->addSeconds(10)
    );

    $response = $this->withoutExceptionHandling()->get('/');
    $this->assertEquals('yes', $response->getContent());
    $this->assertEquals(2, $response->headers->get('X-RateLimit-Limit'));
    $this->assertEquals(0, $response->headers->get('X-RateLimit-Remaining'));

    Carbon::setTestNow(
        Carbon::now()->addSeconds(58)
    );

    try {
        $this->withoutExceptionHandling()->get('/');
    } catch (Throwable $e) {
        $this->assertEquals(429, $e->getStatusCode());
        $this->assertEquals(2, $e->getHeaders()['X-RateLimit-Limit']);
        $this->assertEquals(0, $e->getHeaders()['X-RateLimit-Remaining']);
        $this->assertEquals(2, $e->getHeaders()['Retry-After']);
        $this->assertEquals(Carbon::now()->addSeconds(2)->getTimestamp(), $e->getHeaders()['X-RateLimit-Reset']);
    }
}

我刚刚添加了

Carbon::setTestNow(
    Carbon::now()->addSeconds(10)
);

第一个和第二个请求之间的

。这将导致phpunit的以下输出：

./vendor/bin/phpunit tests/Integration/Http/ThrottleRequestsTest.php
PHPUnit 6.5.5 by Sebastian Bergmann and contributors.

Runtime:       PHP 7.2.1
Configuration: /Volumes/Workspace/Projects/laravel/phpunit.xml.dist

F                                                                   1 / 1 (100%)

Time: 172 ms, Memory: 10.00MB

There was 1 failure:

1) Illuminate\Tests\Integration\Http\ThrottleRequestsTest::test_lock_opens_immediately_after_decay
Failed asserting that -8 matches expected 2.

/Volumes/Workspace/Projects/laravel/tests/Integration/Http/ThrottleRequestsTest.php:54

我已经用失败的测试创建了一个公关〜一旦确认这不是预期的行为，有人可以开始修复它：〜

https://github.com/laravel/framework/pull/22725/files

编辑：正如PR中所述，这是预期的行为。中间件专为API速率限制而设计，您希望确保在特定时间范围内x个请求数量通过。要限制密码尝试，您必须切换基础RateLimiter。

至于为何之前有效，我不能告诉你。

节流时间问题

1 个答案: