Throttle middleware does not always reset after defined duration about framework

[timacdonald]

@kapir, did you happen to change your rate limits when you noticed this, i.e., users were allowed to make more or less requests to the endpoint?

Also, are you noticing this issue for authenticated users or guests? Because you are using an "IP" fallback, it is possible if you have a proxy, like Cloudflare, that the clients actual IP address is not being used to rate limit but instead the proxy's IP address.

Lastly, I would recommend not using the file cache in production. It never clears itself. I would recommend Redis, Memcache, or the database driver.

[kapir]

1. Rate limiting was not changed in this time range. The error still occurs today for our users
2. 99,9% of our traffic is for authenticated user, so we have currently only seen this issue for authenticated users
3. So this indicates that the issue is the file cache? I will follow up on your recommendations.

Thank you for replying

[timacdonald]

I see that 99.9% of users are authenticated but this is only impacting 0.02% of traffic, which does seem to feel like it could be the IP issue I mentioned. I know that isn't perfect math, but it does feel like it fits the story.

I would certainly check you have client IP forwarding configured property anywhere it is needed.