RATE_LIMIT_DEFAULT/RATE_LIMIT_API config keys are dead — editing them in .env has zero effect #80

New Issue

2026-09-01T00:07:14-04:00

jared commented

2026-09-01 00:07:14 -04:00

Severity: Medium

config/config.php (~lines 138-139) defines RATE_LIMIT_DEFAULT/RATE_LIMIT_API, but middleware/RateLimitMiddleware.php never reads them (confirmed by grep — zero references to $GLOBALS['config']['RATE_LIMIT_*'] anywhere). The middleware uses its own hardcoded class constants instead (DEFAULT_LIMIT=100, API_LIMIT=60, IP_LIMIT=300, IP_API_LIMIT=120, WINDOW_SECONDS=60). These two config keys also aren't in .env.example, so there's no documented override path either.

Impact: A deployer who edits RATE_LIMIT_API in .env — a reasonable thing to try, since the key exists and looks like a legitimate tunable — sees zero effect. The actual limit can only be changed by editing the middleware's PHP constants directly, which isn't documented anywhere.

Fix: Either wire RateLimitMiddleware to actually read these config values (making them real, documented tunables — add to .env.example too), or delete the dead config keys from config.php to avoid the false impression they're configurable.

**Severity:** Medium `config/config.php` (~lines 138-139) defines `RATE_LIMIT_DEFAULT`/`RATE_LIMIT_API`, but `middleware/RateLimitMiddleware.php` never reads them (confirmed by grep — zero references to `$GLOBALS['config']['RATE_LIMIT_*']` anywhere). The middleware uses its own hardcoded class constants instead (`DEFAULT_LIMIT=100`, `API_LIMIT=60`, `IP_LIMIT=300`, `IP_API_LIMIT=120`, `WINDOW_SECONDS=60`). These two config keys also aren't in `.env.example`, so there's no documented override path either. **Impact:** A deployer who edits `RATE_LIMIT_API` in `.env` — a reasonable thing to try, since the key exists and looks like a legitimate tunable — sees zero effect. The actual limit can only be changed by editing the middleware's PHP constants directly, which isn't documented anywhere. **Fix:** Either wire `RateLimitMiddleware` to actually read these config values (making them real, documented tunables — add to `.env.example` too), or delete the dead config keys from `config.php` to avoid the false impression they're configurable.

jared added the config priority/medium rate-limiting labels 2026-09-08 10:15:48 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/tinker_tickets#80