Rate Limiting (Symfony)

Use when

• Capping how often a caller may reach an endpoint: login, password reset, public API, any public write.
• Choosing between sliding window, token bucket and fixed window.
• Applying a limiter by controller attribute, in a service, or globally through an event subscriber.
• Returning a correct 429 with Retry-After.
• Blocking until a token frees up, rather than refusing outright.

Default workflow

1. Name what is limited and what identifies the caller.
2. Pick the algorithm the traffic shape calls for, and state the rate and the burst.
3. Declare the policy under framework.rate_limiter, one entry per limiter.
4. Apply it where the request is refused, and answer 429 with Retry-After.
5. Prove the limit under test: the call that passes, the one refused, the reset.