Fix API Rate Limit Exhaustion in CodeIgniter
Rate limit exhaustion isn't just a nuisance; it's a critical vector for automated credential stuffing and resource-layer DoS. In the CodeIgniter 4 ecosystem, developers frequently neglect the built-in Throttler service, leaving endpoints wide open for botnets to saturate the DB connection pool or drain expensive third-party API credits. If you aren't throttling at the middleware or controller level, you're essentially providing a free stress-testing service for attackers.
The Vulnerable Pattern
namespace App\Controllers;\n\nuse CodeIgniter\RESTful\ResourceController;\n\nclass Auth extends ResourceController {\n public function login() {\n // VULNERABILITY: No rate limiting implemented.\n // An attacker can brute-force this endpoint with thousands of requests per second.\n $username = $this->request->getPost('username');\n $password = $this->request->getPost('password');\n \n // Database logic here...\n return $this->respond(['status' => 'processing']);\n }\n}The Secure Implementation
The secure implementation utilizes CodeIgniter's native Throttler service, which implements the Token Bucket algorithm. By calling $throttler->check(), the application validates if the unique key (the hashed IP address) has enough 'tokens' left to proceed. If the limit (5 requests) is exceeded within the timeframe (1 minute), the check returns false, and we immediately terminate the request with a 429 Too Many Requests response. For a scalable architecture, this logic should be abstracted into a Controller Filter (app/Filters/Throttle.php) and applied globally to routes via app/Config/Filters.php.
namespace App\Controllers;\n\nuse CodeIgniter\RESTful\ResourceController;\n\nclass Auth extends ResourceController {\n public function login() {\n $throttler = \Config\Services::throttler();\n\n // Secure: Limit to 5 attempts per minute per IP address\n // We use a MD5 hash of the IP as the bucket key\n if ($throttler->check(md5($this->request->getIPAddress()), 5, MINUTE) === false) {\n return $this->failTooManyRequests('Rate limit exceeded. Try again in a minute.');\n }\n\n $username = $this->request->getPost('username');\n $password = $this->request->getPost('password');\n \n return $this->respond(['status' => 'authorized']);\n }\n}
Your CodeIgniter API
might be exposed to API Rate Limit Exhaustion
74% of CodeIgniter apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.