Rate limiting in Laravel - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user exceeds the rate limit in Laravel?

In Laravel, if a user sends too many requests exceeding the defined rate limit, what is the default response behavior?

A Laravel returns a 429 Too Many Requests HTTP status with a retry-after header.

B Laravel queues the requests and processes them later without any error.

C Laravel automatically redirects the user to the homepage.

D Laravel ignores the limit and processes all requests normally.

💡 Hint

Think about HTTP status codes related to client request limits.

Laravel uses the 429 status code to indicate too many requests. It also sends a retry-after header to tell the client when to try again.

📝 Syntax

intermediate

Which code snippet correctly defines a rate limiter in Laravel?

Choose the correct way to define a rate limiter named 'api' that allows 60 requests per minute.

A RateLimiter::for('api', fn (Request $request) => Limit::perMinute(60));

B RateLimiter::define('api', function() { return 60; });

C RateLimiter::set('api', 60);

D RateLimiter::limit('api', 60)->perMinute();

💡 Hint

Look for the method that uses a closure and Limit::perMinute.

The correct syntax uses RateLimiter::for with a closure returning Limit::perMinute(60).

❓ state_output

advanced

What is the value of $remaining after 3 requests if the limit is 5 per minute?

Given this Laravel code snippet:

use Illuminate\Support\Facades\RateLimiter;

$key = 'user-123';
$limit = RateLimiter::remaining($key, 5);

If the user has made 3 requests so far this minute, what is the value of $limit?

Laravel

use Illuminate\Support\Facades\RateLimiter;

$key = 'user-123';
$limit = RateLimiter::remaining($key, 5);

A 3

B 2

C 5

D 0

💡 Hint

Remaining means how many requests are left before hitting the limit.

If the limit is 5 and 3 requests were made, 2 requests remain.

🔧 Debug

advanced

Why does this Laravel rate limiter code cause a runtime error?

Consider this code:

RateLimiter::for('login', function (Request $request) {
    return Limit::perMinute(10)->by($request->ip());
});

What causes the error?

Laravel

RateLimiter::for('login', function (Request $request) {
    return Limit::perMinute(10)->by($request->ip());
});

A Missing semicolon after Limit::perMinute(10).

B Using a closure instead of an arrow function.

C Accessing $request->ip as a property instead of calling $request->ip() method.

D Not importing the Request class.

💡 Hint

Check how to get the IP address from the request object.

The $request->ip is a method call, so it should be $request->ip() to get the IP address.

🧠 Conceptual

expert

How does Laravel's rate limiter uniquely identify users for limiting?

Which method does Laravel use by default to distinguish different users when applying rate limits?

A It uses the user agent string from the browser.

B It uses only the user’s IP address regardless of authentication.

C It uses a random token generated per request.

D It uses the combination of user IP address and authenticated user ID if available.

💡 Hint

Think about how Laravel can differentiate logged-in users and guests.

Laravel combines the user ID if logged in, or IP address if not, to uniquely identify users for rate limiting.

Practice

1. What is the main purpose of rate limiting in Laravel applications?

easy

A. To speed up database queries automatically

B. To generate API tokens for users

C. To encrypt user passwords securely

D. To control how often users can make requests to keep the app stable

Solution

1. Step 1: Understand the concept of rate limiting

   Rate limiting is used to limit the number of requests a user can make in a given time to prevent overload.

2. Step 2: Identify the purpose in Laravel context

   Laravel uses rate limiting to keep the app stable by controlling request frequency.

3. Final Answer:

   To control how often users can make requests to keep the app stable -> Option D

4. Quick Check:

   Rate limiting = control request frequency [OK]

Hint: Rate limiting controls request frequency to protect apps [OK]

Common Mistakes:

• Confusing rate limiting with database optimization
• Thinking it encrypts data
• Assuming it generates tokens

2. Which of the following is the correct way to define a rate limiter in Laravel using RateLimiter::for?

easy

A. RateLimiter::limit('api', 60);

B. RateLimiter::for('api', fn (Request $request) => Limit::perMinute(60));

C. RateLimiter::set('api', 60);

D. RateLimiter::create('api', 60);

Solution

1. Step 1: Recall Laravel rate limiter syntax

   Laravel uses RateLimiter::for with a closure returning a Limit object.

2. Step 2: Match the correct syntax

   RateLimiter::for('api', fn (Request $request) => Limit::perMinute(60)); correctly uses RateLimiter::for with a closure and Limit::perMinute(60).

3. Final Answer:

   RateLimiter::for('api', fn (Request $request) => Limit::perMinute(60)); -> Option B

4. Quick Check:

   Correct syntax uses RateLimiter::for + Limit::perMinute [OK]

Hint: Use RateLimiter::for with a closure returning Limit [OK]

Common Mistakes:

• Using non-existent methods like set or create
• Passing number directly without Limit::perMinute
• Missing the closure function

3. Given this route definition in Laravel:

Route::middleware('throttle:api')->get('/data', function () { return 'OK'; });

If the rate limiter 'api' allows 2 requests per minute, what will happen on the 3rd request within the same minute?

medium

A. The request will be blocked with a 429 Too Many Requests response

B. The request will succeed and return 'OK'

C. The request will cause a server error 500

D. The request will be queued and delayed

Solution

1. Step 1: Understand the throttle middleware behavior

   The throttle middleware limits requests based on the named limiter, here 'api'.

2. Step 2: Apply the limit of 2 requests per minute

   After 2 requests, the 3rd request exceeds the limit and is blocked with a 429 error.

3. Final Answer:

   The request will be blocked with a 429 Too Many Requests response -> Option A

4. Quick Check:

   Exceed limit = 429 error [OK]

Hint: Requests over limit get 429 error response [OK]

Common Mistakes:

• Assuming requests always succeed
• Thinking server error 500 occurs
• Believing requests get queued automatically

4. Consider this Laravel rate limiter definition:

RateLimiter::for('login', function (Request $request) { return Limit::perMinute(5)->by($request->ip()); });

What is wrong if users report they can make unlimited login attempts?

medium

A. The RateLimiter::for method is deprecated

B. The Limit::perMinute(5) should be Limit::perSecond(5)

C. The limiter is not applied on the login route middleware

D. The by() method should use user ID instead of IP

Solution

1. Step 1: Check if limiter is applied on route

   Defining a limiter alone does not enforce it; middleware must use 'throttle:login'.

2. Step 2: Identify missing middleware usage

   If middleware is missing on login route, rate limiting won't work, allowing unlimited attempts.

3. Final Answer:

   The limiter is not applied on the login route middleware -> Option C

4. Quick Check:

   Limiter defined but not applied = no limit [OK]

Hint: Define limiter and apply middleware to enforce it [OK]

Common Mistakes:

• Thinking perSecond is required instead of perMinute
• Assuming by() must use user ID always
• Believing RateLimiter::for is deprecated

5. You want to create a rate limiter in Laravel that allows 10 requests per minute per user, but if the user is an admin, allow 100 requests per minute. Which code correctly implements this?

hard

A. RateLimiter::for('custom', function (Request $request) { return $request->user()?->isAdmin() ? Limit::perMinute(100)->by($request->user()->id) : Limit::perMinute(10)->by($request->user()->id); });

B. RateLimiter::for('custom', fn(Request $request) => Limit::perMinute(10));

C. RateLimiter::for('custom', function (Request $request) { if ($request->user()->isAdmin()) { return Limit::perMinute(10); } else { return Limit::perMinute(100); } });

D. RateLimiter::for('custom', fn(Request $request) => Limit::perMinute($request->user()->isAdmin() ? 10 : 100));

Solution

1. Step 1: Check conditional logic for admin and normal users

   Admins get 100 requests/min, others get 10 requests/min, keyed by user ID.

2. Step 2: Verify correct use of ternary and by() method

   RateLimiter::for('custom', function (Request $request) { return $request->user()?->isAdmin() ? Limit::perMinute(100)->by($request->user()->id) : Limit::perMinute(10)->by($request->user()->id); }); uses ternary to select limit and keys by user ID, handling null user safely.

3. Final Answer:

   RateLimiter::for('custom', function (Request $request) { return $request->user()?->isAdmin() ? Limit::perMinute(100)->by($request->user()->id) : Limit::perMinute(10)->by($request->user()->id); }); -> Option A

4. Quick Check:

   Conditional limits with by(user ID) = RateLimiter::for('custom', function (Request $request) { return $request->user()?->isAdmin() ? Limit::perMinute(100)->by($request->user()->id) : Limit::perMinute(10)->by($request->user()->id); }); [OK]

Hint: Use ternary inside RateLimiter::for with by(user id) [OK]

Common Mistakes:

• Swapping admin and user limits
• Not keying limits by user ID
• Using wrong ternary logic or missing by()