rate limit in yii2 vs using nginx for rate limiting

Question

what is difference between rate limiting via yii2 versus using nginx for example as reverse proxy and rate limiter ?

REF: Yii2 Rate Limiting Api

Answer 1

Application rate limit (like yii2) more flexible. You can write different limits per user, for example. Or put request to some queue for future execution. But each request over that limit still hit PHP scripts.

Nginx limits less flexible, but allow to stop request before PHP script.

Nginx limits usually used as DOS protection. Usual task: do not allow to spawn too much PHP processes from one IP, for example.

Application rate limit used as application backend overloading protection. It's can be database or external API. Also, application limits can be used as part of business logic (different rate limits for different tariff plans, etc)

Answer 2

The difference is in what layer of your web application you configure the rate limit for the calls of your api server.

in the first case Yii2, you configure a limitation directly in the php code.

With the yii\filters\RateLimitInterface you implement the methods in an Identity class (the model used for manage the data for the api calls), then yii will automatically use the yii\filters\RateLimiter for adding the limit headers to the response.

Conversely, in nginx you set this limitation directly in the Http Server configuration, the server will take charge of dialogue with the headers and then limit the requests.

The real Question here is "What should i use the yii or the nginx approach?". The answer can mute in the way you will build your api services.

Lots of people can say that using the http server for take care of this aspect is the most "Naturally" way, however yii2 give you can use php to customize the rate limiting, and this come to your advantage when you want to develop an api server with a medium/high level of complexity.

In some (very) rare case you can combine yii2 with nginx for obtain something even more custom.