Rate limiting in Laravel

Introduction

Rate limiting helps control how many times a user or system can make requests in a short time. It stops overload and keeps apps running smoothly.

To stop users from sending too many requests and slowing down your app.

To protect login pages from too many attempts and possible hacking.

To limit API calls so your service stays fast and fair for everyone.

To avoid extra costs from too many requests to third-party services.

To keep your server safe during traffic spikes or attacks.

Syntax

Laravel

use Illuminate\Support\Facades\RateLimiter;
use Illuminate\Cache\RateLimiting\Limit;

RateLimiter::for('key', function (\Illuminate\Http\Request $request) {
    return Limit::perMinute(10);
});

Use RateLimiter::for to define limits by a key name.

Limit::perMinute(10) means max 10 requests per minute.

Examples

Limits login attempts to 5 per minute per IP address.

Laravel

use Illuminate\Http\Request;
use Illuminate\Cache\RateLimiting\Limit;

RateLimiter::for('login', function (Request $request) {
    return Limit::perMinute(5)->by($request->ip());
});

Limits API calls to 60 per minute per user ID or IP if not logged in.

Laravel

use Illuminate\Http\Request;
use Illuminate\Cache\RateLimiting\Limit;

RateLimiter::for('api', function (Request $request) {
    return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip());
});

Sets a global limit of 100 requests per minute without user distinction.

Laravel

use Illuminate\Cache\RateLimiting\Limit;

RateLimiter::for('global', function () {
    return Limit::perMinute(100);
});

Sample Program

This example sets a rate limit of 5 login attempts per minute per IP address. If a user tries more, Laravel will block extra requests automatically.

The route uses the throttle:login middleware to apply the limit.

Laravel

<?php

namespace App\Providers;

use Illuminate\Support\Facades\RateLimiter;
use Illuminate\Foundation\Support\Providers\RouteServiceProvider as ServiceProvider;
use Illuminate\Http\Request;
use Illuminate\Cache\RateLimiting\Limit;

class RouteServiceProvider extends ServiceProvider
{
    public function boot()
    {
        RateLimiter::for('login', function (Request $request) {
            return Limit::perMinute(5)->by($request->ip());
        });
    }
}

// In routes/web.php

use Illuminate\Support\Facades\Route;

Route::middleware(['throttle:login'])->group(function () {
    Route::post('/login', function () {
        return 'Login attempt accepted';
    });
});

Important Notes

Laravel automatically sends a 429 status code if the limit is exceeded.

You can customize the response by handling exceptions or using custom middleware.

Use meaningful keys for limits to organize different rate rules.

Summary

Rate limiting controls how often users can make requests to keep apps stable.

Laravel uses RateLimiter::for to define limits by keys.

Apply limits with middleware like throttle:key on routes.

Practice

1. What is the main purpose of rate limiting in Laravel applications?

easy

A. To speed up database queries automatically

B. To generate API tokens for users

C. To encrypt user passwords securely

D. To control how often users can make requests to keep the app stable

Solution

1. Step 1: Understand the concept of rate limiting

   Rate limiting is used to limit the number of requests a user can make in a given time to prevent overload.

2. Step 2: Identify the purpose in Laravel context

   Laravel uses rate limiting to keep the app stable by controlling request frequency.

3. Final Answer:

   To control how often users can make requests to keep the app stable -> Option D

4. Quick Check:

   Rate limiting = control request frequency [OK]

Hint: Rate limiting controls request frequency to protect apps [OK]

Common Mistakes:

• Confusing rate limiting with database optimization
• Thinking it encrypts data
• Assuming it generates tokens

2. Which of the following is the correct way to define a rate limiter in Laravel using RateLimiter::for?

easy

A. RateLimiter::limit('api', 60);

B. RateLimiter::for('api', fn (Request $request) => Limit::perMinute(60));

C. RateLimiter::set('api', 60);

D. RateLimiter::create('api', 60);

Solution

1. Step 1: Recall Laravel rate limiter syntax

   Laravel uses RateLimiter::for with a closure returning a Limit object.

2. Step 2: Match the correct syntax

   RateLimiter::for('api', fn (Request $request) => Limit::perMinute(60)); correctly uses RateLimiter::for with a closure and Limit::perMinute(60).

3. Final Answer:

   RateLimiter::for('api', fn (Request $request) => Limit::perMinute(60)); -> Option B

4. Quick Check:

   Correct syntax uses RateLimiter::for + Limit::perMinute [OK]

Hint: Use RateLimiter::for with a closure returning Limit [OK]

Common Mistakes:

• Using non-existent methods like set or create
• Passing number directly without Limit::perMinute
• Missing the closure function

3. Given this route definition in Laravel:

Route::middleware('throttle:api')->get('/data', function () { return 'OK'; });

If the rate limiter 'api' allows 2 requests per minute, what will happen on the 3rd request within the same minute?

medium

A. The request will be blocked with a 429 Too Many Requests response

B. The request will succeed and return 'OK'

C. The request will cause a server error 500

D. The request will be queued and delayed

Solution

1. Step 1: Understand the throttle middleware behavior

   The throttle middleware limits requests based on the named limiter, here 'api'.

2. Step 2: Apply the limit of 2 requests per minute

   After 2 requests, the 3rd request exceeds the limit and is blocked with a 429 error.

3. Final Answer:

   The request will be blocked with a 429 Too Many Requests response -> Option A

4. Quick Check:

   Exceed limit = 429 error [OK]

Hint: Requests over limit get 429 error response [OK]

Common Mistakes:

• Assuming requests always succeed
• Thinking server error 500 occurs
• Believing requests get queued automatically

4. Consider this Laravel rate limiter definition:

RateLimiter::for('login', function (Request $request) { return Limit::perMinute(5)->by($request->ip()); });

What is wrong if users report they can make unlimited login attempts?

medium

A. The RateLimiter::for method is deprecated

B. The Limit::perMinute(5) should be Limit::perSecond(5)

C. The limiter is not applied on the login route middleware

D. The by() method should use user ID instead of IP

Solution

1. Step 1: Check if limiter is applied on route

   Defining a limiter alone does not enforce it; middleware must use 'throttle:login'.

2. Step 2: Identify missing middleware usage

   If middleware is missing on login route, rate limiting won't work, allowing unlimited attempts.

3. Final Answer:

   The limiter is not applied on the login route middleware -> Option C

4. Quick Check:

   Limiter defined but not applied = no limit [OK]

Hint: Define limiter and apply middleware to enforce it [OK]

Common Mistakes:

• Thinking perSecond is required instead of perMinute
• Assuming by() must use user ID always
• Believing RateLimiter::for is deprecated

5. You want to create a rate limiter in Laravel that allows 10 requests per minute per user, but if the user is an admin, allow 100 requests per minute. Which code correctly implements this?

hard

A. RateLimiter::for('custom', function (Request $request) { return $request->user()?->isAdmin() ? Limit::perMinute(100)->by($request->user()->id) : Limit::perMinute(10)->by($request->user()->id); });

B. RateLimiter::for('custom', fn(Request $request) => Limit::perMinute(10));

C. RateLimiter::for('custom', function (Request $request) { if ($request->user()->isAdmin()) { return Limit::perMinute(10); } else { return Limit::perMinute(100); } });

D. RateLimiter::for('custom', fn(Request $request) => Limit::perMinute($request->user()->isAdmin() ? 10 : 100));

Solution

1. Step 1: Check conditional logic for admin and normal users

   Admins get 100 requests/min, others get 10 requests/min, keyed by user ID.

2. Step 2: Verify correct use of ternary and by() method

   RateLimiter::for('custom', function (Request $request) { return $request->user()?->isAdmin() ? Limit::perMinute(100)->by($request->user()->id) : Limit::perMinute(10)->by($request->user()->id); }); uses ternary to select limit and keys by user ID, handling null user safely.

3. Final Answer:

   RateLimiter::for('custom', function (Request $request) { return $request->user()?->isAdmin() ? Limit::perMinute(100)->by($request->user()->id) : Limit::perMinute(10)->by($request->user()->id); }); -> Option A

4. Quick Check:

   Conditional limits with by(user ID) = RateLimiter::for('custom', function (Request $request) { return $request->user()?->isAdmin() ? Limit::perMinute(100)->by($request->user()->id) : Limit::perMinute(10)->by($request->user()->id); }); [OK]

Hint: Use ternary inside RateLimiter::for with by(user id) [OK]

Common Mistakes:

• Swapping admin and user limits
• Not keying limits by user ID
• Using wrong ternary logic or missing by()