Web uygulamalar\u0131m\u0131z\u0131n omurgas\u0131 haline gelen API’ler (Uygulama Programlama Aray\u00fczleri), dijital d\u00fcnyada veri al\u0131\u015fveri\u015finin ve servis entegrasyonunun vazge\u00e7ilmez bir par\u00e7as\u0131d\u0131r. Ancak bu g\u00fc\u00e7l\u00fc ara\u00e7lar, ayn\u0131 zamanda k\u00f6t\u00fc niyetli akt\u00f6rlerin hedefi haline gelebilir. Bir API’nin a\u015f\u0131r\u0131 veya k\u00f6t\u00fcye kullan\u0131m\u0131, sunucu kaynaklar\u0131n\u0131n t\u00fckenmesinden hassas verilere yetkisiz eri\u015fime kadar ciddi g\u00fcvenlik ve performans sorunlar\u0131na yol a\u00e7abilir. Peki, Laravel gibi modern bir framework (yaz\u0131l\u0131m \u00e7er\u00e7evesi) kullanarak API’lerimizi bu t\u00fcr tehditlere kar\u015f\u0131 nas\u0131l koruyabiliriz? Geli\u015fmi\u015f h\u0131z s\u0131n\u0131rlama (rate limiting) teknikleri, bu sorunun cevab\u0131n\u0131n \u00f6nemli bir par\u00e7as\u0131d\u0131r.<\/p>\n
API’ler, g\u00fcn\u00fcm\u00fcz\u00fcn ba\u011flant\u0131l\u0131 d\u00fcnyas\u0131nda uygulamalar aras\u0131ndaki ileti\u015fimi sa\u011flayan hayati k\u00f6pr\u00fclerdir. Mobil uygulamalar\u0131m\u0131z, tek sayfa uygulamalar\u0131m\u0131z (SPA), hatta di\u011fer backend servislerimiz bile API’ler arac\u0131l\u0131\u011f\u0131yla birbiriyle konu\u015fur. Bu a\u00e7\u0131kl\u0131k, geli\u015ftirme kolayl\u0131\u011f\u0131 ve esneklik sunarken, ayn\u0131 zamanda potansiyel g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 da beraberinde getirir. Bir API k\u00f6t\u00fcye kullan\u0131ld\u0131\u011f\u0131nda, sonu\u00e7lar sadece finansal kay\u0131plarla s\u0131n\u0131rl\u0131 kalmaz; itibar kayb\u0131, m\u00fc\u015fteri g\u00fcveninin sars\u0131lmas\u0131 ve yasal sorunlar da ortaya \u00e7\u0131kabilir.<\/p>\n
API k\u00f6t\u00fcye kullan\u0131m\u0131n\u0131n \u00e7e\u015fitli bi\u00e7imleri vard\u0131r. \u00d6rne\u011fin, bir siber sald\u0131rgan, bir giri\u015f (login) API’sine milyonlarca deneme iste\u011fi g\u00f6ndererek kaba kuvvet (brute-force) sald\u0131r\u0131s\u0131 d\u00fczenleyebilir. Bu durum, hem sunucu kaynaklar\u0131n\u0131 t\u00fcketir hem de kullan\u0131c\u0131 hesaplar\u0131n\u0131n ele ge\u00e7irilme riskini art\u0131r\u0131r. Bir ba\u015fka senaryoda, rakipler veya k\u00f6t\u00fc niyetli botlar, halka a\u00e7\u0131k bir API’den a\u015f\u0131r\u0131 miktarda veri \u00e7ekmeye \u00e7al\u0131\u015farak, servisin di\u011fer me\u015fru kullan\u0131c\u0131lar i\u00e7in yava\u015flamas\u0131na veya tamamen eri\u015filemez hale gelmesine neden olabilir. Bu t\u00fcr bir hizmet reddi (Denial of Service – DoS) veya da\u011f\u0131t\u0131lm\u0131\u015f hizmet reddi (Distributed Denial of Service – DDoS) sald\u0131r\u0131s\u0131, bir i\u015fletmenin operasyonlar\u0131n\u0131 fel\u00e7 edebilir.<\/p>\n
H\u0131z s\u0131n\u0131rlama (rate limiting), bu tehditlere kar\u015f\u0131 ilk savunma hatlar\u0131ndan biridir. Temel olarak, belirli bir zaman dilimi i\u00e7inde bir istemcinin yapabilece\u011fi istek say\u0131s\u0131n\u0131 k\u0131s\u0131tlar. Bu k\u0131s\u0131tlama, IP adresi, API anahtar\u0131, oturum kimli\u011fi (session ID) veya kullan\u0131c\u0131 kimli\u011fi (user ID) gibi \u00e7e\u015fitli tan\u0131mlay\u0131c\u0131lara g\u00f6re uygulanabilir. H\u0131z s\u0131n\u0131rlama uygulayarak, \u015funlar\u0131 sa\u011flayabiliriz:<\/p>\n
Laravel, bu kritik g\u00fcvenlik \u00f6nlemini uygulamak i\u00e7in g\u00fc\u00e7l\u00fc ve esnek mekanizmalar sunar. Hem temel senaryolar hem de karma\u015f\u0131k, dinamik ihtiya\u00e7lar i\u00e7in \u00e7\u00f6z\u00fcmler geli\u015ftirmenize olanak tan\u0131r. API g\u00fcvenli\u011fi sadece bir eklenti de\u011fil, bir uygulaman\u0131n temel bir par\u00e7as\u0131 olmal\u0131d\u0131r ve h\u0131z s\u0131n\u0131rlama, bu sa\u011flam g\u00fcvenlik duru\u015funun ayr\u0131lmaz bir bile\u015fenidir.<\/p>\n
Laravel, h\u0131z s\u0131n\u0131rlamay\u0131 (rate limiting) uygulaman\u0131n temelden geli\u015fmi\u015fe kadar bir\u00e7ok yolunu sunar. \u00c7ekirdek olarak, Laravel’in Varsay\u0131lan olarak, Laravel’in Yeni bir h\u0131z s\u0131n\u0131rlay\u0131c\u0131 tan\u0131mlamak i\u00e7in, genellikle Yukar\u0131daki \u00f6rnekte, iki farkl\u0131 h\u0131z s\u0131n\u0131rlay\u0131c\u0131 tan\u0131mlad\u0131k:<\/p>\n Tan\u0131mlanan bu h\u0131z s\u0131n\u0131rlay\u0131c\u0131lar\u0131 rotalar\u0131n\u0131za uygulamak olduk\u00e7a basittir. Bu yap\u0131land\u0131rma, uygulaman\u0131z\u0131n API’lerini k\u00f6t\u00fcye kullan\u0131ma kar\u015f\u0131 korumak i\u00e7in sa\u011flam bir temel olu\u015fturur. Temel h\u0131z s\u0131n\u0131rlama, bir\u00e7ok senaryo i\u00e7in yeterli olsa da, modern web uygulamalar\u0131n\u0131n kar\u015f\u0131la\u015ft\u0131\u011f\u0131 karma\u015f\u0131k tehditler ve dinamik kullan\u0131m senaryolar\u0131, daha geli\u015fmi\u015f stratejiler gerektirir. Laravel’in Birincil geli\u015fmi\u015f stratejilerden biri, dinamik limitler uygulamakt\u0131r. \u00d6rne\u011fin, premium aboneli\u011fe sahip kullan\u0131c\u0131lar i\u00e7in standart kullan\u0131c\u0131lardan daha y\u00fcksek bir istek limiti belirlemek isteyebilirsiniz. Bu, API’nizin de\u011ferini art\u0131r\u0131rken, ayn\u0131 zamanda farkl\u0131 hizmet seviyeleri sunman\u0131za olanak tan\u0131r. Bu \u00f6rnekte, e\u011fer kullan\u0131c\u0131 premium ise dakikada 500 istek, de\u011filse dakikada 100 istek limiti uygulan\u0131r. Bu, API’nizin farkl\u0131 kullan\u0131c\u0131 segmentleri i\u00e7in farkl\u0131 performans garantileri sunmas\u0131n\u0131 sa\u011flar.<\/p>\n Bir di\u011fer \u00f6nemli geli\u015fmi\u015f strateji, \u00f6zel anahtarlar (custom keys) kullanmakt\u0131r. Varsay\u0131lan olarak, Laravel h\u0131z s\u0131n\u0131rlamay\u0131 IP adresine g\u00f6re yapar. Ancak, baz\u0131 durumlarda bu yeterli olmayabilir. \u00d6rne\u011fin, bir API anahtar\u0131 (API key) ile eri\u015filen bir serviste, her anahtar i\u00e7in ayr\u0131 bir limit belirlemek isteyebilirsiniz. Veya bir e-ticaret uygulamas\u0131nda, her \u00fcr\u00fcn i\u00e7in belirli bir s\u00fcre i\u00e7inde yap\u0131lan yorum say\u0131s\u0131n\u0131 s\u0131n\u0131rlamak i\u00e7in \u00fcr\u00fcn ID’sini anahtar olarak kullanabilirsiniz. Bu \u00f6rnek, belirli bir \u00fcr\u00fcn ID’si ve kullan\u0131c\u0131 ID’si kombinasyonu i\u00e7in saatte 10 yorum iste\u011fi limiti belirler. Bu, bir kullan\u0131c\u0131n\u0131n ayn\u0131 \u00fcr\u00fcn hakk\u0131nda a\u015f\u0131r\u0131 yorum yapmas\u0131n\u0131 veya botlar\u0131n belirli \u00fcr\u00fcnlere spam yorumlar g\u00f6ndermesini engelleyebilir.<\/p>\n Son olarak, patlama (burst) limitleri ve bekleme s\u00fcreleri (decay rates) gibi kavramlar da geli\u015fmi\u015f h\u0131z s\u0131n\u0131rlama stratejilerinin bir par\u00e7as\u0131d\u0131r. Laravel’in Bu geli\u015fmi\u015f teknikler, API’lerinizi daha ak\u0131ll\u0131, daha diren\u00e7li ve daha g\u00fcvenli hale getirir. Her senaryo i\u00e7in tek bir “en iyi” \u00e7\u00f6z\u00fcm yoktur; \u00f6nemli olan, uygulaman\u0131z\u0131n \u00f6zel ihtiya\u00e7lar\u0131n\u0131 ve kar\u015f\u0131la\u015ft\u0131\u011f\u0131 potansiyel tehditleri anlamak ve h\u0131z s\u0131n\u0131rlama stratejilerinizi buna g\u00f6re uyarlamakt\u0131r. Laravel’in sundu\u011fu esneklik sayesinde, bu t\u00fcr \u00f6zelle\u015ftirmeleri kolayca ger\u00e7ekle\u015ftirebilirsiniz.<\/p>\n Bir e-ticaret platformu olan “Anadolu El Sanatlar\u0131” \u00f6rne\u011fini ele alal\u0131m. Bu platform, T\u00fcrkiye’nin d\u00f6rt bir yan\u0131ndaki el sanatlar\u0131 ustalar\u0131n\u0131n \u00fcr\u00fcnlerini sergiliyor ve d\u00fcnya \u00e7ap\u0131nda sat\u0131\u015f yap\u0131yor. Platformun API’leri, mobil uygulamalar\u0131ndan web sitesine, hatta i\u015f ortaklar\u0131n\u0131n envanter sistemlerine kadar bir\u00e7ok noktada kullan\u0131l\u0131yor. \u00d6zellikle pop\u00fcler bir \u00fcr\u00fcn lansman\u0131 veya \u00f6zel bir kampanya d\u00f6neminde, API’lere gelen istek trafi\u011fi katlanarak artabiliyor. Ancak, bu art\u0131\u015f\u0131n her zaman me\u015fru kullan\u0131c\u0131 trafi\u011finden kaynakland\u0131\u011f\u0131n\u0131 s\u00f6yleyemeyiz; bazen k\u00f6t\u00fc niyetli botlar veya rakip firmalar taraf\u0131ndan yap\u0131lan veri kaz\u0131ma (data scraping) giri\u015fimleri, hatta do\u011frudan DDoS (Distributed Denial of Service) sald\u0131r\u0131lar\u0131 da s\u00f6z konusu olabiliyor.<\/p>\n Bir g\u00fcn, Anadolu El Sanatlar\u0131, yeni bir kampanya ba\u015flatt\u0131\u011f\u0131nda, API’lerinde beklenmedik bir yava\u015flama ve hatta baz\u0131 b\u00f6lgelerde tamamen eri\u015filemezlik ya\u015fad\u0131. Sunucu loglar\u0131 incelendi\u011finde, belirli API rotalar\u0131na (\u00f6zellikle \u00fcr\u00fcn listeleme ve stok sorgulama) saniyede binlerce istek geldi\u011fi fark edildi. Bu istekler, farkl\u0131 IP adreslerinden gelmesine ra\u011fmen, benzer paternler sergiliyordu ve insan davran\u0131\u015f\u0131ndan \u00e7ok bir bot a\u011f\u0131na i\u015faret ediyordu. Bu durum, tipik bir DDoS sald\u0131r\u0131s\u0131yd\u0131 ve platformun me\u015fru kullan\u0131c\u0131lar\u0131n\u0131n al\u0131\u015fveri\u015f yapmas\u0131n\u0131 engelliyordu.<\/p>\n \u0130\u015fte bu noktada geli\u015fmi\u015f h\u0131z s\u0131n\u0131rlama devreye girdi. Anadolu El Sanatlar\u0131 ekibi, Laravel uygulamalar\u0131nda daha \u00f6nce uygulad\u0131klar\u0131 temel IP tabanl\u0131 h\u0131z s\u0131n\u0131rlaman\u0131n yetersiz kald\u0131\u011f\u0131n\u0131 fark etti. \u00c7\u00fcnk\u00fc DDoS sald\u0131r\u0131s\u0131nda istekler y\u00fczlerce, hatta binlerce farkl\u0131 IP adresinden geliyordu ve her bir IP adresi i\u00e7in bireysel limitler, genel sistemi korumaya yetmiyordu. Ekip, a\u015fa\u011f\u0131daki geli\u015fmi\u015f stratejileri uygulad\u0131:<\/p>\n Bu, botlar\u0131n giri\u015f yapma zorunlulu\u011fu olmamas\u0131 nedeniyle daha d\u00fc\u015f\u00fck limitlere tak\u0131lmas\u0131n\u0131 sa\u011flad\u0131.\n <\/li>\n Bu geli\u015fmi\u015f h\u0131z s\u0131n\u0131rlama stratejileri sayesinde, Anadolu El Sanatlar\u0131 platformu, DDoS sald\u0131r\u0131s\u0131n\u0131n etkisini \u00f6nemli \u00f6l\u00e7\u00fcde azaltt\u0131. Bot trafi\u011fi h\u0131zla k\u0131s\u0131tland\u0131 ve me\u015fru kullan\u0131c\u0131lar i\u00e7in API performans\u0131 normale d\u00f6nd\u00fc. Bu vaka analizi, h\u0131z s\u0131n\u0131rlaman\u0131n sadece basit bir g\u00fcvenlik \u00f6nlemi olmad\u0131\u011f\u0131n\u0131, ayn\u0131 zamanda i\u015f s\u00fcreklili\u011fi ve m\u00fc\u015fteri memnuniyeti i\u00e7in kritik bir ara\u00e7 oldu\u011funu a\u00e7\u0131k\u00e7a g\u00f6stermektedir. \u00d6zellikle y\u00fcksek trafikli veya sald\u0131r\u0131 riski ta\u015f\u0131yan uygulamalar i\u00e7in, geli\u015fmi\u015f ve dinamik h\u0131z s\u0131n\u0131rlama stratejileri hayati \u00f6neme sahiptir.<\/p>\n Laravel’in sundu\u011fu \u00d6zel bir h\u0131z s\u0131n\u0131rlay\u0131c\u0131 geli\u015ftirmenin en yayg\u0131n yolu, yine \u00d6rne\u011fin, bir kullan\u0131c\u0131n\u0131n son 5 dakika i\u00e7inde yapt\u0131\u011f\u0131 ba\u015far\u0131s\u0131z giri\u015f denemelerinin say\u0131s\u0131n\u0131 takip etmek ve bu say\u0131 belirli bir e\u015fi\u011fi a\u015ft\u0131\u011f\u0131nda kullan\u0131c\u0131y\u0131 ge\u00e7ici olarak engellemek isteyebilirsiniz. Bu, kaba kuvvet sald\u0131r\u0131lar\u0131na kar\u015f\u0131 daha proaktif bir savunma sa\u011flar. Bu t\u00fcr bir senaryo i\u00e7in \u00f6zel bir h\u0131z s\u0131n\u0131rlay\u0131c\u0131 \u015f\u00f6yle g\u00f6r\u00fcnebilir:<\/p>\n Bu \u00f6rnekte, Bu yakla\u015f\u0131m, Laravel’in dahili h\u0131z s\u0131n\u0131rlama mekanizmalar\u0131n\u0131 kendi \u00f6zel g\u00fcvenlik ve i\u015f mant\u0131\u011f\u0131n\u0131zla birle\u015ftirmenize olanak tan\u0131r. Daha da ileri gitmek isterseniz, kendi \u00f6zel middleware’inizi yazarak, Modern web uygulamalar\u0131 genellikle tek bir sunucuda \u00e7al\u0131\u015fmaz; aksine, y\u00fcksek eri\u015filebilirlik, performans ve \u00f6l\u00e7eklenebilirlik sa\u011flamak i\u00e7in birden fazla sunucu (load balancer (y\u00fck dengeleyici) arkas\u0131nda) veya mikroservis mimarileri kullan\u0131r. Bu da\u011f\u0131t\u0131k ortamlar, h\u0131z s\u0131n\u0131rlama (rate limiting) stratejileri i\u00e7in \u00f6nemli zorluklar ortaya \u00e7\u0131kar\u0131r. E\u011fer her sunucu kendi ba\u015f\u0131na istekleri sayarsa, bir istemci farkl\u0131 sunuculara istek g\u00f6ndererek h\u0131z limitlerini kolayca a\u015fabilir. Bu nedenle, da\u011f\u0131t\u0131k ortamlarda h\u0131z s\u0131n\u0131rlaman\u0131n do\u011fru bir \u015fekilde \u00e7al\u0131\u015fabilmesi i\u00e7in, t\u00fcm sunucular\u0131n payla\u015f\u0131lan bir “ger\u00e7ek zamanl\u0131” istek sayac\u0131na eri\u015febilmesi gerekir.<\/p>\n Laravel, bu sorunu \u00e7\u00f6zmek i\u00e7in \u00f6nbellek (cache) s\u00fcr\u00fcc\u00fcs\u00fcn\u00fc kullan\u0131r. Varsay\u0131lan olarak, Laravel’in Redis ile Da\u011f\u0131t\u0131k H\u0131z S\u0131n\u0131rlama:<\/strong><\/p>\n Redis, bellek i\u00e7i (in-memory) bir veri yap\u0131s\u0131 sunucusu oldu\u011fu i\u00e7in, \u00e7ok h\u0131zl\u0131 okuma ve yazma i\u015flemleri sa\u011flar. Bu \u00f6zellik, h\u0131z s\u0131n\u0131rlama saya\u00e7lar\u0131n\u0131 depolamak ve g\u00fcncellemek i\u00e7in onu ideal bir aday yapar. Laravel uygulaman\u0131z\u0131 Redis kullanacak \u015fekilde yap\u0131land\u0131rd\u0131\u011f\u0131n\u0131zda ( Bu yap\u0131land\u0131rma ile, Laravel’in Y\u00fcksek \u00d6l\u00e7eklenebilirlik \u0130\u00e7in Ek Hususlar:<\/strong><\/p>\n Da\u011f\u0131t\u0131k ortamlarda h\u0131z s\u0131n\u0131rlama, sadece bir g\u00fcvenlik \u00f6zelli\u011fi de\u011fil, ayn\u0131 zamanda uygulaman\u0131z\u0131n performans\u0131n\u0131 ve kullan\u0131c\u0131 deneyimini do\u011frudan etkileyen bir \u00f6l\u00e7eklenebilirlik sorunudur. Redis gibi g\u00fc\u00e7l\u00fc ara\u00e7lar ve Laravel’in esnek mimarisi sayesinde, bu karma\u015f\u0131k zorluklar\u0131n \u00fcstesinden gelmek ve API’lerinizi her \u00f6l\u00e7ekte korumak m\u00fcmk\u00fcnd\u00fcr.<\/p>\n API’ler, modern yaz\u0131l\u0131m mimarilerinin kalbinde yer al\u0131r ve dijital ekosistemin sorunsuz \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flar. Ancak bu g\u00fc\u00e7, beraberinde k\u00f6t\u00fcye kullan\u0131m riskini de getirir. Laravel’de geli\u015fmi\u015f h\u0131z s\u0131n\u0131rlama (rate limiting) teknikleri, API’lerinizi kaba kuvvet sald\u0131r\u0131lar\u0131ndan, veri kaz\u0131madan ve hizmet reddi (DoS\/DDoS) sald\u0131r\u0131lar\u0131ndan korumak i\u00e7in vazge\u00e7ilmez bir savunma mekanizmas\u0131 sunar. Bu makalede, Laravel’in temel h\u0131z s\u0131n\u0131rlama \u00f6zelliklerinden ba\u015flayarak, dinamik limitler, \u00f6zel anahtarlar ve da\u011f\u0131t\u0131k ortamlarda Redis kullan\u0131m\u0131 gibi ileri d\u00fczey stratejilere kadar bir\u00e7ok konuyu ele ald\u0131k. Unutmay\u0131n ki, API g\u00fcvenli\u011fi s\u00fcrekli bir s\u00fcre\u00e7tir ve uygulaman\u0131z\u0131n \u00f6zel ihtiya\u00e7lar\u0131na g\u00f6re h\u0131z s\u0131n\u0131rlama stratejilerinizi d\u00fczenli olarak g\u00f6zden ge\u00e7irmek ve g\u00fcncellemek \u00f6nemlidir.<\/p>\n Geli\u015fmi\u015f h\u0131z s\u0131n\u0131rlama uygulayarak, sadece sunucu kaynaklar\u0131n\u0131z\u0131 korumakla kalmaz, ayn\u0131 zamanda API’lerinizin performans\u0131n\u0131 ve me\u015fru kullan\u0131c\u0131lar\u0131n\u0131z i\u00e7in adil bir kullan\u0131m deneyimini de garanti alt\u0131na al\u0131rs\u0131n\u0131z. Bu, hem teknik bir zorunluluk hem de i\u015f s\u00fcreklili\u011fi ve itibar y\u00f6netimi a\u00e7\u0131s\u0131ndan kritik bir ad\u0131md\u0131r. Laravel’in sa\u011flad\u0131\u011f\u0131 esnek ve g\u00fc\u00e7l\u00fc ara\u00e7larla, API’lerinizi g\u00fcvende tutmak art\u0131k \u00e7ok daha eri\u015filebilir.<\/p>\n Uygun h\u0131z limitleri, API’nizin kullan\u0131m senaryosuna, hedef kitlenize ve kaynak t\u00fcketimine g\u00f6re de\u011fi\u015fir. \u00d6rne\u011fin, bir genel veri API’si i\u00e7in dakikada 100-500 istek makul olabilirken, kritik bir i\u015flem API’si i\u00e7in dakikada 5-10 istek daha uygun olabilir. Kullan\u0131m analizi yaparak ve potansiyel k\u00f6t\u00fcye kullan\u0131m senaryolar\u0131n\u0131 de\u011ferlendirerek en iyi limitleri belirleyebilirsiniz.<\/p>\n<\/li>\n Do\u011fru uyguland\u0131\u011f\u0131nda, h\u0131z s\u0131n\u0131rlama performans\u0131 olumsuz etkilemek yerine iyile\u015ftirir. A\u015f\u0131r\u0131 isteklerin sunucunuza ula\u015fmas\u0131n\u0131 engelleyerek, sunucu kaynaklar\u0131n\u0131n me\u015fru istekler i\u00e7in serbest kalmas\u0131n\u0131 sa\u011flar. Ancak, yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f veya a\u015f\u0131r\u0131 karma\u015f\u0131k h\u0131z s\u0131n\u0131rlay\u0131c\u0131lar, kendileri bir performans darbo\u011faz\u0131 olu\u015fturabilir. Redis gibi h\u0131zl\u0131 \u00f6nbellek sistemleri kullanmak bu riski minimize eder.<\/p>\n<\/li>\n H\u0131z s\u0131n\u0131rlama, DDoS sald\u0131r\u0131lar\u0131na kar\u015f\u0131 \u00f6nemli bir savunma katman\u0131d\u0131r ancak tek ba\u015f\u0131na tam koruma sa\u011flamaz. \u00d6zellikle b\u00fcy\u00fck \u00f6l\u00e7ekli ve sofistike DDoS sald\u0131r\u0131lar\u0131, h\u0131z s\u0131n\u0131rlama katman\u0131n\u0131 a\u015fabilir. Tam koruma i\u00e7in, CDN (Content Delivery Network), WAF (Web Application Firewall) ve \u00f6zel DDoS koruma hizmetleri gibi ek g\u00fcvenlik \u00e7\u00f6z\u00fcmleriyle birlikte kullan\u0131lmas\u0131 \u00f6nerilir.<\/p>\n<\/li>\n H\u0131z limitlerine ula\u015fan kullan\u0131c\u0131lara anla\u015f\u0131l\u0131r HTTP durum kodlar\u0131 (\u00f6rne\u011fin, 429 Too Many Requests) ve a\u00e7\u0131klay\u0131c\u0131 mesajlar (\u00f6rne\u011fin, “L\u00fctfen X dakika sonra tekrar deneyin”) d\u00f6nd\u00fcr\u00fclmelidir. Ayr\u0131ca, HTTP yan\u0131t ba\u015fl\u0131klar\u0131nda ( #Laravel #APIG\u00fcvenli\u011fi #RateLimiting #WebGeli\u015ftirme #SiberG\u00fcvenlik<\/p>\nThrottleRequests<\/code> middleware (ara yaz\u0131l\u0131m\u0131) ve RateLimiter<\/code> facade (cephesi) bu i\u015flevselli\u011fi sa\u011flar. Bu ara\u00e7lar, uygulaman\u0131z\u0131n belirli rotalar\u0131na veya rotalar gruplar\u0131na kolayca k\u0131s\u0131tlamalar eklemenizi m\u00fcmk\u00fcn k\u0131lar. Laravel’in h\u0131z s\u0131n\u0131rlama mekanizmas\u0131, genellikle Redis veya veritaban\u0131 gibi bir \u00f6nbellek s\u00fcr\u00fcc\u00fcs\u00fcyle \u00e7al\u0131\u015farak, istekleri sayar ve limitlere ula\u015f\u0131ld\u0131\u011f\u0131nda yan\u0131tlar\u0131 k\u0131s\u0131tlar.<\/p>\napi<\/code> middleware grubu, throttle:api<\/code> ad\u0131nda bir h\u0131z s\u0131n\u0131rlay\u0131c\u0131ya sahiptir. Bu s\u0131n\u0131rlay\u0131c\u0131, genellikle 60 istek\/dakika limitini kullan\u0131r ve her iste\u011fi istemcinin IP adresine g\u00f6re takip eder. Bu, \u00e7o\u011fu temel API i\u00e7in iyi bir ba\u015flang\u0131\u00e7 noktas\u0131d\u0131r. Ancak, projenizin ihtiya\u00e7lar\u0131na g\u00f6re bu limitleri \u00f6zelle\u015ftirebilir veya tamamen yeni limitler tan\u0131mlayabilirsiniz.<\/p>\nApp\\Providers\\RouteServiceProvider<\/code> s\u0131n\u0131f\u0131nda bulunan configureRateLimiting<\/code> metodunu kullan\u0131r\u0131z. \u0130\u015fte temel bir \u00f6rnek:<\/p>\n\nuse Illuminate\\Cache\\RateLimiting\\Limit;\nuse Illuminate\\Support\\Facades\\RateLimiter;\nuse Illuminate\\Support\\Facades\\Auth;\n\n\/\/ ...\n\nprotected function configureRateLimiting()\n{\n RateLimiter::for('global', function (Request $request) {\n return Limit::perMinute(100)->by($request->user()?->id ?: $request->ip());\n });\n\n RateLimiter::for('uploads', function (Request $request) {\n return Limit::perMinute(5)->by($request->user()?->id)->response(function () {\n return response('Y\u00fckleme limitinize ula\u015ft\u0131n\u0131z.', 429);\n });\n });\n}\n <\/code><\/pre>\n<\/p><\/div>\n\n
global<\/code>: Her kullan\u0131c\u0131 veya misafir IP adresi i\u00e7in dakikada 100 iste\u011fe izin verir. Kullan\u0131c\u0131 giri\u015fi yapm\u0131\u015fsa kullan\u0131c\u0131 ID’sini, yapmam\u0131\u015fsa IP adresini baz al\u0131r.<\/li>\nuploads<\/code>: Giri\u015f yapm\u0131\u015f her kullan\u0131c\u0131 i\u00e7in dakikada 5 y\u00fckleme iste\u011fi ile s\u0131n\u0131rlar. Bu s\u0131n\u0131rlay\u0131c\u0131ya ula\u015f\u0131ld\u0131\u011f\u0131nda, \u00f6zel bir yan\u0131t (429 HTTP durumu kodu ile birlikte ‘Y\u00fckleme limitinize ula\u015ft\u0131n\u0131z.’ mesaj\u0131) d\u00f6nd\u00fcr\u00fcr.<\/li>\n<\/ul>\nthrottle<\/code> middleware’ini kullanabilirsiniz:<\/p>\n\nuse Illuminate\\Support\\Facades\\Route;\n\nRoute::middleware(['throttle:global'])->group(function () {\n Route::get('\/api\/posts', function () {\n \/\/ ...\n });\n \/\/ Di\u011fer global API rotalar\u0131\n});\n\nRoute::middleware(['auth:sanctum', 'throttle:uploads'])->group(function () {\n Route::post('\/api\/upload', function () {\n \/\/ ...\n });\n});\n <\/code><\/pre>\n<\/p><\/div>\nthrottle<\/code> middleware’i, tan\u0131mlad\u0131\u011f\u0131n\u0131z s\u0131n\u0131rlay\u0131c\u0131n\u0131n ad\u0131n\u0131 al\u0131r (\u00f6rne\u011fin, global<\/code> veya uploads<\/code>). E\u011fer bir isim belirtmezseniz, Laravel varsay\u0131lan olarak throttle:60,1<\/code> (dakikada 60 istek) kullan\u0131r. Ayr\u0131ca, throttle:10,10<\/code> gibi do\u011frudan de\u011ferler de belirtebilirsiniz, bu da 10 dakikada 10 iste\u011fe izin verir. Laravel’in temel h\u0131z s\u0131n\u0131rlama \u00f6zellikleri, genellikle basit ve orta d\u00fczeydeki ihtiya\u00e7lar i\u00e7in yeterli olup, uygulaman\u0131z\u0131n performans\u0131n\u0131 ve g\u00fcvenli\u011fini \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131r\u0131r.<\/p>\nGeli\u015fmi\u015f H\u0131z S\u0131n\u0131rlama Stratejileri: Daha Ak\u0131ll\u0131 Koruma Nas\u0131l Sa\u011flan\u0131r?<\/h3>\n
RateLimiter<\/code> facade’i ve esnek middleware yap\u0131s\u0131, bu ileri d\u00fczey ihtiya\u00e7lar\u0131 kar\u015f\u0131lamak i\u00e7in g\u00fc\u00e7l\u00fc olanaklar sunar. Geli\u015fmi\u015f h\u0131z s\u0131n\u0131rlama, sadece istek say\u0131s\u0131n\u0131 k\u0131s\u0131tlaman\u0131n \u00f6tesine ge\u00e7erek, kullan\u0131c\u0131 davran\u0131\u015flar\u0131n\u0131, rol tabanl\u0131 yetkilendirmeleri ve hatta \u00f6deme planlar\u0131n\u0131 dikkate alabilir.<\/p>\nRateLimiter::for<\/code> metodunun i\u00e7inde, $request<\/code> nesnesine eri\u015fiminiz oldu\u011fu i\u00e7in, kullan\u0131c\u0131n\u0131n rol\u00fcn\u00fc veya abonelik durumunu kontrol edebilir ve buna g\u00f6re dinamik olarak bir limit d\u00f6nd\u00fcrebilirsiniz:<\/p>\n\nuse Illuminate\\Cache\\RateLimiting\\Limit;\nuse Illuminate\\Http\\Request;\nuse Illuminate\\Support\\Facades\\RateLimiter;\n\n\/\/ ...\n\nprotected function configureRateLimiting()\n{\n RateLimiter::for('premium_users', function (Request $request) {\n if ($request->user() && $request->user()->isPremium()) {\n return Limit::perMinute(500)->by($request->user()->id);\n }\n return Limit::perMinute(100)->by($request->ip()); \/\/ Standart kullan\u0131c\u0131lar veya misafirler\n });\n\n \/\/ ... di\u011fer s\u0131n\u0131rlay\u0131c\u0131lar\n}\n <\/code><\/pre>\n<\/p><\/div>\nby()<\/code> metodu ile bu anahtar\u0131 kolayca de\u011fi\u015ftirebilirsiniz:<\/p>\n\nRateLimiter::for('product_comments', function (Request $request) {\n return Limit::perHour(10)->by($request->input('product_id') . ':' . $request->user()->id);\n});\n <\/code><\/pre>\n<\/p><\/div>\nLimit<\/code> s\u0131n\u0131f\u0131, perMinute()<\/code>, perHour()<\/code> gibi y\u00f6ntemlerin yan\u0131 s\u0131ra, daha esnek limitler tan\u0131mlaman\u0131za olanak tan\u0131r. \u00d6rne\u011fin, bir kullan\u0131c\u0131n\u0131n k\u0131sa bir s\u00fcre i\u00e7inde y\u00fcksek say\u0131da istek yapmas\u0131na izin verip, ard\u0131ndan bu isteklere daha yava\u015f bir oranda devam etmesini sa\u011flamak isteyebilirsiniz. Bu, “token bucket” (jeton kovas\u0131) algoritmas\u0131na benzer bir yakla\u015f\u0131mla, ani y\u00fcklenmeleri y\u00f6netmeye yard\u0131mc\u0131 olabilir.<\/p>\nVaka Analizi: DDoS Sald\u0131r\u0131lar\u0131na Kar\u015f\u0131 Ger\u00e7ek D\u00fcnya Senaryolar\u0131nda Geli\u015fmi\u015f H\u0131z S\u0131n\u0131rlama Nas\u0131l Hayat Kurtar\u0131r?<\/h3>\n
\n
\nRateLimiter::for('public_api', function (Request $request) {\n if ($request->user()) {\n return Limit::perMinute(300)->by($request->user()->id); \/\/ Giri\u015f yapm\u0131\u015f kullan\u0131c\u0131\n }\n return Limit::perMinute(50)->by($request->ip()); \/\/ Misafir kullan\u0131c\u0131\/bot\n});\n <\/code><\/pre>\n<\/p><\/div>\n\nRateLimiter::for('partner_api', function (Request $request) {\n $apiKey = $request->header('X-API-KEY');\n if ($apiKey && $partner = Partner::findByApiKey($apiKey)) {\n return Limit::perMinute($partner->api_limit)->by($apiKey);\n }\n return Limit::perMinute(10)->by($request->ip()); \/\/ Ge\u00e7ersiz anahtar veya eksik\n});\n <\/code><\/pre>\n<\/p><\/div>\n<\/li>\n\n\/\/ Rotan\u0131n tan\u0131m\u0131 i\u00e7inde\nRoute::post('\/api\/orders', function () { \/* ... *\/ })->middleware('throttle:order_creation');\n\n\/\/ RouteServiceProvider i\u00e7inde\nRateLimiter::for('order_creation', function (Request $request) {\n return Limit::perMinute(3)->by($request->user()->id); \/\/ Her kullan\u0131c\u0131 i\u00e7in dakikada 3 sipari\u015f\n});\n <\/code><\/pre>\n<\/p><\/div>\n<\/li>\nRateLimiter<\/code>‘\u0131 varsay\u0131lan olarak \u00f6nbellek s\u00fcr\u00fcc\u00fcs\u00fcn\u00fc kulland\u0131\u011f\u0131 i\u00e7in, Redis yap\u0131land\u0131rmas\u0131yla bu otomatik olarak sa\u011fland\u0131 ve t\u00fcm sunucular\u0131n ayn\u0131 h\u0131z s\u0131n\u0131rlama kurallar\u0131n\u0131 uygulamas\u0131n\u0131 garanti etti.<\/li>\n<\/ol>\n\u00d6zel Rate Limiter’lar Geli\u015ftirmek: \u0130htiya\u00e7lar\u0131n\u0131za \u00d6zel \u00c7\u00f6z\u00fcmler Nas\u0131l Olu\u015fturulur?<\/h3>\n
RateLimiter<\/code> facade’i ve Limit<\/code> s\u0131n\u0131f\u0131, \u00e7o\u011fu senaryo i\u00e7in yeterli esnekli\u011fi sa\u011flasa da, bazen uygulaman\u0131z\u0131n benzersiz gereksinimlerini kar\u015f\u0131lamak i\u00e7in tamamen \u00f6zel h\u0131z s\u0131n\u0131rlay\u0131c\u0131lar geli\u015ftirmeniz gerekebilir. Bu, \u00f6zellikle karma\u015f\u0131k i\u015f mant\u0131\u011f\u0131na dayal\u0131 k\u0131s\u0131tlamalar uygulaman\u0131z gerekti\u011finde veya Laravel’in varsay\u0131lan \u00f6nbellek tabanl\u0131 yakla\u015f\u0131m\u0131n\u0131n \u00f6tesine ge\u00e7meniz gerekti\u011finde \u00f6nem kazan\u0131r. \u00d6zel h\u0131z s\u0131n\u0131rlay\u0131c\u0131lar, Laravel’in sa\u011flad\u0131\u011f\u0131 altyap\u0131y\u0131 kullanarak, kendi mant\u0131\u011f\u0131n\u0131z\u0131 devreye sokman\u0131za olanak tan\u0131r.<\/p>\nRouteServiceProvider<\/code> i\u00e7indeki configureRateLimiting<\/code> metodunu kullanmak, ancak bu sefer RateLimiter::for<\/code> metodunun ikinci parametresine daha karma\u015f\u0131k bir Closure (kapan\u0131\u015f) sa\u011flamakt\u0131r. Bu Closure, Illuminate\\Http\\Request<\/code> \u00f6rne\u011fini al\u0131r ve bir Limit<\/code> nesnesi d\u00f6nd\u00fcrmelidir. Ancak, Limit<\/code> nesnesini olu\u015ftururken, daha \u00f6nce bahsetti\u011fimiz by()<\/code>, perMinute()<\/code> gibi metotlar\u0131 kullanmak yerine, tamamen kendi mant\u0131\u011f\u0131n\u0131z\u0131 uygulayabilirsiniz.<\/p>\n\nuse Illuminate\\Cache\\RateLimiting\\Limit;\nuse Illuminate\\Http\\Request;\nuse Illuminate\\Support\\Facades\\RateLimiter;\nuse Illuminate\\Support\\Facades\\Cache;\n\n\/\/ ...\n\nprotected function configureRateLimiting()\n{\n \/\/ ... di\u011fer s\u0131n\u0131rlay\u0131c\u0131lar\n\n RateLimiter::for('failed_login_attempts', function (Request $request) {\n $username = $request->input('email'); \/\/ veya kullan\u0131c\u0131 ad\u0131 alan\u0131\n $key = 'login_attempts:' . $username;\n $maxAttempts = 5;\n $decayMinutes = 10; \/\/ 10 dakika i\u00e7inde s\u0131f\u0131rlan\u0131r\n\n \/\/ Kullan\u0131c\u0131n\u0131n ba\u015far\u0131s\u0131z deneme say\u0131s\u0131n\u0131 art\u0131r\n Cache::increment($key);\n Cache::put($key, Cache::get($key, 0), now()->addMinutes($decayMinutes));\n\n \/\/ E\u011fer deneme say\u0131s\u0131 limiti a\u015ft\u0131ysa, iste\u011fi k\u0131s\u0131tla\n if (Cache::get($key) > $maxAttempts) {\n return Limit::perMinutes($decayMinutes, 0)->by($username)->response(function () {\n return response('\u00c7ok fazla ba\u015far\u0131s\u0131z giri\u015f denemesi. L\u00fctfen ' . $decayMinutes . ' dakika sonra tekrar deneyin.', 429);\n });\n }\n\n \/\/ Limit a\u015f\u0131lmad\u0131ysa, s\u0131n\u0131rs\u0131z eri\u015fim veya ba\u015fka bir limit d\u00f6nd\u00fcr\n return Limit::none(); \/\/ veya Limit::perMinute(60)->by($username);\n });\n}\n <\/code><\/pre>\n<\/p><\/div>\nfailed_login_attempts<\/code> ad\u0131nda \u00f6zel bir s\u0131n\u0131rlay\u0131c\u0131 tan\u0131mlad\u0131k. Bu s\u0131n\u0131rlay\u0131c\u0131, kullan\u0131c\u0131n\u0131n e-posta adresine g\u00f6re ba\u015far\u0131s\u0131z giri\u015f denemelerini \u00f6nbellekte (Cache) tutar. E\u011fer deneme say\u0131s\u0131 5’i a\u015farsa, kullan\u0131c\u0131 10 dakika boyunca engellenir ve \u00f6zel bir yan\u0131t al\u0131r. Aksi takdirde, Limit::none()<\/code> d\u00f6nd\u00fcrerek bu s\u0131n\u0131rlay\u0131c\u0131n\u0131n iste\u011fi engellemeyece\u011fini belirtiriz (ancak ba\u015fka bir s\u0131n\u0131rlay\u0131c\u0131 devreye girebilir).<\/p>\nRateLimiter<\/code> facade’ini veya do\u011frudan \u00f6nbelle\u011fi kullanarak \u00e7ok daha karma\u015f\u0131k h\u0131z s\u0131n\u0131rlama algoritmalar\u0131 (\u00f6rne\u011fin, kayan pencere (sliding window) veya token bucket algoritmas\u0131n\u0131n tam uygulamas\u0131) uygulayabilirsiniz. Bu, \u00f6zellikle y\u00fcksek \u00f6l\u00e7ekli uygulamalar veya \u00e7ok \u00f6zel g\u00fcvenlik gereksinimleri olan sistemler i\u00e7in faydal\u0131d\u0131r. Kendi middleware’inizi olu\u015fturmak, iste\u011fi tamamen kontrol etmenizi ve iste\u011fin her a\u015famas\u0131nda \u00f6zel kararlar alman\u0131z\u0131 sa\u011flar. Bu esneklik, Laravel’in en g\u00fc\u00e7l\u00fc yanlar\u0131ndan biridir ve API’lerinizi her t\u00fcrl\u00fc k\u00f6t\u00fcye kullan\u0131ma kar\u015f\u0131 korumak i\u00e7in s\u0131n\u0131rs\u0131z se\u00e7enek sunar.<\/p>\nDa\u011f\u0131t\u0131k Ortamlarda H\u0131z S\u0131n\u0131rlama: Y\u00fcksek \u00d6l\u00e7eklenebilirlik Nas\u0131l Y\u00f6netilir?<\/h3>\n
RateLimiter<\/code>‘\u0131, uygulaman\u0131z\u0131n yap\u0131land\u0131r\u0131lm\u0131\u015f \u00f6nbellek s\u00fcr\u00fcc\u00fcs\u00fcn\u00fc (genellikle .env<\/code> dosyas\u0131ndaki CACHE_DRIVER<\/code>) kullanarak istekleri takip eder. Da\u011f\u0131t\u0131k ortamlarda, bu \u00f6nbellek s\u00fcr\u00fcc\u00fcs\u00fcn\u00fcn t\u00fcm sunucular taraf\u0131ndan eri\u015filebilen merkezi bir depolama olmas\u0131 kritik \u00f6neme sahiptir. \u0130\u015fte bu noktada Redis gibi h\u0131zl\u0131, anahtar-de\u011fer tabanl\u0131 bir veri deposu devreye girer.<\/p>\nCACHE_DRIVER=redis<\/code> ve Redis ba\u011flant\u0131 bilgilerini config\/database.php<\/code> i\u00e7inde tan\u0131mlayarak), RateLimiter<\/code> otomatik olarak Redis’i kullanmaya ba\u015flar. Her bir sunucu, bir istemciden gelen iste\u011fi i\u015fledi\u011finde, Redis’teki ilgili sayac\u0131 g\u00fcnceller ve mevcut limitleri kontrol eder. Bu sayede, t\u00fcm sunucular ayn\u0131, g\u00fcncel bilgilere sahip olur ve h\u0131z s\u0131n\u0131rlama kurallar\u0131 tutarl\u0131 bir \u015fekilde uygulan\u0131r.<\/p>\n\n\/\/ .env dosyas\u0131nda\nCACHE_DRIVER=redis\nREDIS_HOST=127.0.0.1\nREDIS_PASSWORD=null\nREDIS_PORT=6379\n\n\/\/ config\/database.php dosyas\u0131nda Redis yap\u0131land\u0131rmas\u0131\n'redis' => [\n 'client' => env('REDIS_CLIENT', 'predis'), \/\/ veya 'phpredis'\n 'default' => [\n 'url' => env('REDIS_URL'),\n 'host' => env('REDIS_HOST', '127.0.0.1'),\n 'password' => env('REDIS_PASSWORD', null),\n 'port' => env('REDIS_PORT', '6379'),\n 'database' => env('REDIS_DB', '0'),\n ],\n],\n <\/code><\/pre>\n<\/p><\/div>\nRateLimiter<\/code>‘\u0131 otomatik olarak Redis \u00fczerinden \u00e7al\u0131\u015facak ve da\u011f\u0131t\u0131k ortam\u0131n\u0131zdaki t\u00fcm sunucular\u0131n ayn\u0131 h\u0131z s\u0131n\u0131rlama mant\u0131\u011f\u0131n\u0131 payla\u015fmas\u0131n\u0131 sa\u011flayacakt\u0131r. Bu, bir istemcinin farkl\u0131 sunuculara istek g\u00f6ndererek limitleri a\u015fmas\u0131n\u0131 engeller ve uygulaman\u0131z\u0131n genel g\u00fcvenli\u011fini ve istikrar\u0131n\u0131 art\u0131r\u0131r.<\/p>\n\n
Sonu\u00e7 ve S\u0131k\u00e7a Sorulan Sorular<\/h3>\n
S\u0131k\u00e7a Sorulan Sorular<\/h4>\n
\n
X-RateLimit-Limit<\/code>, X-RateLimit-Remaining<\/code>, X-RateLimit-Reset<\/code>) kalan istek say\u0131s\u0131 ve s\u0131f\u0131rlanma zaman\u0131 gibi bilgiler sunmak, API kullan\u0131c\u0131lar\u0131n\u0131n kendi isteklerini y\u00f6netmelerine yard\u0131mc\u0131 olur.<\/p>\n<\/li>\n<\/ul>\n