未登录用户的速率限制？

Question

public function behaviors()
    {
        return [
            'rateLimiter' => [
            'class' => \yii\filters\RateLimiter::className(),
            'enableRateLimitHeaders' =>false
        ],
    ];
    }

public function getRateLimit($request, $action)
    {
        // 6 - кол-во
        // 10 - это секунды
        return [6, 10];
    }

    public function loadAllowance($request, $action)
    {
        return [$this->allowance, $this->allowance_updated_at];
    }

    /**
     * Метод сохранит в кеш
     * @param \yii\web\Request $request
     * @param \yii\base\Action $action
     * @param int $allowance
     * @param int $timestamp
     */
    public function saveAllowance($request, $action, $allowance, $timestamp)
    {
        $this->allowance = $allowance;
        $this->allowance_updated_at = $timestamp;
        $this->save();
    }

The point is that logging is happening with android application without using session. Just sent in the response token which is the id of the logged-in user.

Answer 1

1. You can take the help of cookies, I'm not sure how cookie works in android apps. You can opt for temporary files.

2. You can log the IP of the non logged in user and keep in in your database as long as you want to keep the limit.

However, users can bypass the limit if you implement it in either of the above ways, by deleting cookies/temporary files or IP.