GuardAPI Logo
GuardAPI

Fix Lack of Resources & Rate Limiting in Yii

Unrestricted endpoints in Yii are a gateway to DoS and automated brute-force attacks. If you aren't implementing the RateLimitInterface, you're leaving the door open for resource exhaustion. Here's how to lock down your controllers using Yii's native rate limiting middleware to prevent attackers from hammering your API or login logic.

The Vulnerable Pattern

class AuthController extends \yii\rest\Controller {
    public function actionLogin() {
        // VULNERABILITY: No rate limiting implemented.
        // An attacker can send thousands of requests per second to brute-force credentials.
        $model = new LoginForm();
        if ($model->load(Yii::$app->request->post(), '') && $model->login()) {
            return ['token' => $model->user->api_key];
        }
        return $model;
    }
}

The Secure Implementation

To mitigate resource exhaustion, Yii provides the `yii\filters\RateLimiter` behavior. The secure implementation requires the User identity class to implement `RateLimitInterface`, which tracks the 'allowance' (remaining requests) and the timestamp of the last request in the database or cache. When the `RateLimiter` filter is added to the controller's behaviors, it automatically checks these values before executing any action. If the limit is exceeded, Yii throws a `yii\web\TooManyRequestsHttpException` (HTTP 429). This prevents automated tools from consuming server resources or successfully executing brute-force attacks.

// 1. Implement RateLimitInterface in your User Identity class
class User extends ActiveRecord implements IdentityInterface, RateLimitInterface {
    public function getRateLimit($request, $action) {
        return [5, 60]; // Allow 5 requests per 60 seconds
    }

public function loadAllowance($request, $action) {
    return [$this->allowance, $this->allowance_updated_at];
}

public function saveAllowance($request, $action, $allowance, $timestamp) {
    $this->allowance = $allowance;
    $this->allowance_updated_at = $timestamp;
    $this->save();
}


}


// 2. Attach the RateLimiter filter in your Controller
class AuthController extends \yii\rest\Controller {
public function behaviors() {
$behaviors = parent::behaviors();
$behaviors[‘rateLimiter’] = [
‘class’ => \yii\filters\RateLimiter::class,
‘enableRateLimitHeaders’ => true,
];
return $behaviors;
}
}

System Alert • ID: 6875
Target: Yii API
Potential Vulnerability

Your Yii API might be exposed to Lack of Resources & Rate Limiting

74% of Yii apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.

RUN FREE SECURITY DIAGNOSTIC
GuardLabs Engine: ONLINE

Free Tier • No Credit Card • Instant Report

Verified by Ghost Labs Security Team

This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.

About GuardLabs → Follow us on X