Skip to content

Commit 3709aaf

Browse files
lasomethingsomethinglasomethingsomething
authored
Merge branch 'main' into dh-updates-jul2026
2 parents dc632fa + a2485ef commit 3709aaf

1 file changed

Lines changed: 36 additions & 12 deletions

File tree

‎guides/hosting/infrastructure/rate-limiter.md‎

Lines changed: 36 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,31 @@ This functionality is available starting with Shopware 6.4.6.0.
1515

1616
Shopware 6 provides certain rate limits by default that reduces the risk of brute-force attacks for pages like login or password reset.
1717

18+
These rate limiters are always active. You do not need to add the `shopware.api.rate_limiter` map to your `shopware.yml` for them to work. The core already ships with the defaults documented below, and the `shopware.yml` is only used to override them (for example, to raise a limit or disable a limiter).
19+
20+
## Default rate limiters
21+
22+
The following limiters are enabled by default. The values listed here reflect the current Shopware core configuration and may change between versions. When in doubt, the source of truth is `src/Core/Framework/Resources/config/packages/shopware.yaml` in the version you are running.
23+
24+
| Limiter | Protects | Since | Policy | Reset | Limits |
25+
|-------------------------------|---------------------------------------------------------------------|----------|------------------|----------|------------------------------------------------------------|
26+
| `login` | Storefront / Store-API customer authentication | 6.4.6.0 | `time_backoff` | 24 hours | 10 / 10s, 15 / 30s, 20 / 60s |
27+
| `guest_login` | Storefront / Store-API after-order guest authentication | 6.4.6.0 | `time_backoff` | 24 hours | 10 / 10s, 15 / 30s, 20 / 60s |
28+
| `oauth` | API OAuth authentication / Administration login | 6.4.6.0 | `time_backoff` | 24 hours | 10 / 10s, 15 / 30s, 20 / 60s |
29+
| `reset_password` | Storefront / Store-API customer password reset | 6.4.6.0 | `time_backoff` | 24 hours | 3 / 30s, 5 / 60s, 10 / 90s |
30+
| `user_recovery` | Administration user password recovery | 6.4.6.0 | `time_backoff` | 24 hours | 3 / 30s, 5 / 60s, 10 / 90s |
31+
| `contact_form` | Storefront / Store-API contact form | 6.4.6.0 | `time_backoff` | 24 hours | 3 / 30s, 5 / 60s, 10 / 90s |
32+
| `notification` | Store-API notification endpoint | 6.4.8.0 | `time_backoff` | 24 hours | 10 / 10s, 15 / 30s, 20 / 60s |
33+
| `newsletter_form` | Store-API newsletter registration | 6.4.16.0 | `time_backoff` | 24 hours | 3 / 30s, 5 / 60s, 10 / 90s |
34+
| `cart_add_line_item` | Adding line items to the cart | 6.4.18.0 | `system_config` | 1 hour | Limit read from `core.cart.lineItemAddLimit`, interval 60s |
35+
| `revocation_request_form` | Store-API revocation request form | 6.7.9.0 | `time_backoff` | 24 hours | 3 / 30s, 5 / 60s, 10 / 90s |
36+
| `newsletter_unsubscribe_form` | Store-API newsletter unsubscribe | 6.7.9.0 | `time_backoff` | 24 hours | 3 / 30s, 5 / 60s, 10 / 90s |
37+
| `app_shop_verify` | App shop registration verification | 6.7.9.0 | `sliding_window` | n/a | 60 / 60min |
38+
| `mcp_admin_api` | MCP server Admin API access (keyed per OAuth token) | 6.8.0.0 | `time_backoff` | 1 hour | 300 / 60s, 1000 / 10min |
39+
| `mcp_store_api` | MCP server Store API access (keyed per sales-channel context token) | 6.8.0.0 | `time_backoff` | 1 hour | 120 / 60s, 600 / 10min |
40+
41+
In the table above, `Limits` uses the `limit / interval` notation, and `s` / `min` are seconds / minutes. When you add a new default limiter to the core, add a row here with its introduction version so this table stays complete.
42+
1843
## Configuration
1944

2045
The configuration for the rate limiter of Shopware 6 resides in the general bundle configuration:
@@ -26,19 +51,13 @@ The configuration for the rate limiter of Shopware 6 resides in the general bund
2651
└── shopware.yml
2752
```
2853

29-
To configure the default rate limiters for your shop, you need to add the `shopware.api.rate_limiter` map to the `shopware.yml`. Under this key, you can separately define the rate limiters.
54+
To override the [default rate limiters](#default-rate-limiters) for your shop, you need to add the `shopware.api.rate_limiter` map to the `shopware.yml`. Under this key, you can separately define each rate limiter. Any key you set is merged into the defaults, so you only need to configure the values you want to change.
3055

31-
In the following, you can find a list of the default limiters:
56+
The following example disables the `login` limiter and overrides the `oauth` limiter:
3257

33-
- `login`: Storefront / Store-API customer authentication.
34-
- `guest_login`: Storefront / Store-API after order guest authentication.
35-
- `oauth`: API oauth authentication / Administration login.
36-
- `reset_password`: Storefront / Store-API customer password reset.
37-
- `user_recovery`: Administration user password recovery.
38-
- `contact_form`: Storefront / Store-API contact form.
58+
::: code-group
3959

40-
```yaml
41-
// <shop root>/config/packages/shopware.yaml
60+
```yaml [SHOP_ROOT/config/packages/shopware.yaml]
4261
shopware:
4362
api:
4463
rate_limiter:
@@ -55,6 +74,8 @@ shopware:
5574
interval: '60 seconds'
5675
```
5776
77+
:::
78+
5879
::: info
5980
The following optional limiters are available starting with Shopware 6.7.10.0.
6081
:::
@@ -70,8 +91,9 @@ The `time_backoff` policy is built by Shopware itself. It enables you to throttl
7091
Below you can find an example which throttles the request for 10 seconds after 3 requests and starting from 5 requests it always
7192
throttles for 60 seconds. If there are no more requests, it will be reset after 24 hours.
7293

73-
```yaml
74-
// <plugin root>/src/Resources/config/rate_limiter.yaml
94+
::: code-group
95+
96+
```yaml [PLUGIN_ROOT/src/Resources/config/rate_limiter.yaml]
7597
example_route:
7698
enabled: true
7799
policy: 'time_backoff'
@@ -82,3 +104,5 @@ example_route:
82104
- limit: 5
83105
interval: '60 seconds'
84106
```
107+
108+
:::

0 commit comments

Comments
 (0)