Rate limiting in Laravel - Performance & Optimization

Performance: Rate limiting

HIGH IMPACT

Rate limiting controls how often users can make requests, impacting server load and response times.

Preventing excessive API requests from users

Laravel

use Illuminate\Cache\RateLimiter;

public function handle(Request $request, Closure $next) {
  $key = $request->ip();
  $maxAttempts = 60;
  $decayMinutes = 1;

  if (app(RateLimiter::class)->tooManyAttempts($key, $maxAttempts)) {
    return response('Too many requests', 429);
  }

  app(RateLimiter::class)->hit($key, $decayMinutes * 60);
  return $next($request);
}

Limits requests per user, reducing server load and keeping response times fast.

📈 Performance GainPrevents server overload; maintains low latency and stable INP

Preventing excessive API requests from users

Laravel

public function handle(Request $request, Closure $next) {
  // No rate limiting
  return $next($request);
}

No limits cause server overload under high traffic, slowing responses and risking downtime.

📉 Performance CostBlocks rendering for many users during overload; increases server CPU and memory usage

Performance Comparison

Pattern	DOM Operations	Reflows	Paint Cost	Verdict
No rate limiting	N/A	N/A	N/A	[X] Bad
Laravel built-in rate limiting middleware	N/A	N/A	N/A	[OK] Good

Rendering Pipeline

Rate limiting happens before request processing, reducing server work and avoiding slow responses that delay browser rendering.

→Server Request Handling

→Response Time

⚠️ BottleneckServer CPU and memory under high request volume

Core Web Vital Affected

INP

Rate limiting controls how often users can make requests, impacting server load and response times.

Optimization Tips

1Always apply rate limiting early in request handling to reduce server load.

2Use Laravel's built-in rate limiter for efficient and easy implementation.

3Monitor 429 responses in DevTools Network tab to verify rate limiting is active.

Performance Quiz - 3 Questions

What is the main performance benefit of using rate limiting in Laravel?

A It prevents server overload and keeps response times fast

B It reduces the size of CSS files

C It improves browser rendering speed directly

D It caches all user requests

DevTools: Network

How to check: Open DevTools, go to Network tab, make rapid repeated requests to API endpoint, observe response status codes.

What to look for: Look for 429 status codes indicating rate limiting is active; absence means no limits.

Practice

1. What is the main purpose of rate limiting in Laravel applications?

easy

A. To speed up database queries automatically

B. To generate API tokens for users

C. To encrypt user passwords securely

D. To control how often users can make requests to keep the app stable

Solution

1. Step 1: Understand the concept of rate limiting

   Rate limiting is used to limit the number of requests a user can make in a given time to prevent overload.

2. Step 2: Identify the purpose in Laravel context

   Laravel uses rate limiting to keep the app stable by controlling request frequency.

3. Final Answer:

   To control how often users can make requests to keep the app stable -> Option D

4. Quick Check:

   Rate limiting = control request frequency [OK]

Hint: Rate limiting controls request frequency to protect apps [OK]

Common Mistakes:

• Confusing rate limiting with database optimization
• Thinking it encrypts data
• Assuming it generates tokens

2. Which of the following is the correct way to define a rate limiter in Laravel using RateLimiter::for?

easy

A. RateLimiter::limit('api', 60);

B. RateLimiter::for('api', fn (Request $request) => Limit::perMinute(60));

C. RateLimiter::set('api', 60);

D. RateLimiter::create('api', 60);

Solution

1. Step 1: Recall Laravel rate limiter syntax

   Laravel uses RateLimiter::for with a closure returning a Limit object.

2. Step 2: Match the correct syntax

   RateLimiter::for('api', fn (Request $request) => Limit::perMinute(60)); correctly uses RateLimiter::for with a closure and Limit::perMinute(60).

3. Final Answer:

   RateLimiter::for('api', fn (Request $request) => Limit::perMinute(60)); -> Option B

4. Quick Check:

   Correct syntax uses RateLimiter::for + Limit::perMinute [OK]

Hint: Use RateLimiter::for with a closure returning Limit [OK]

Common Mistakes:

• Using non-existent methods like set or create
• Passing number directly without Limit::perMinute
• Missing the closure function

3. Given this route definition in Laravel:

Route::middleware('throttle:api')->get('/data', function () { return 'OK'; });

If the rate limiter 'api' allows 2 requests per minute, what will happen on the 3rd request within the same minute?

medium

A. The request will be blocked with a 429 Too Many Requests response

B. The request will succeed and return 'OK'

C. The request will cause a server error 500

D. The request will be queued and delayed

Solution

1. Step 1: Understand the throttle middleware behavior

   The throttle middleware limits requests based on the named limiter, here 'api'.

2. Step 2: Apply the limit of 2 requests per minute

   After 2 requests, the 3rd request exceeds the limit and is blocked with a 429 error.

3. Final Answer:

   The request will be blocked with a 429 Too Many Requests response -> Option A

4. Quick Check:

   Exceed limit = 429 error [OK]

Hint: Requests over limit get 429 error response [OK]

Common Mistakes:

• Assuming requests always succeed
• Thinking server error 500 occurs
• Believing requests get queued automatically

4. Consider this Laravel rate limiter definition:

RateLimiter::for('login', function (Request $request) { return Limit::perMinute(5)->by($request->ip()); });

What is wrong if users report they can make unlimited login attempts?

medium

A. The RateLimiter::for method is deprecated

B. The Limit::perMinute(5) should be Limit::perSecond(5)

C. The limiter is not applied on the login route middleware

D. The by() method should use user ID instead of IP

Solution

1. Step 1: Check if limiter is applied on route

   Defining a limiter alone does not enforce it; middleware must use 'throttle:login'.

2. Step 2: Identify missing middleware usage

   If middleware is missing on login route, rate limiting won't work, allowing unlimited attempts.

3. Final Answer:

   The limiter is not applied on the login route middleware -> Option C

4. Quick Check:

   Limiter defined but not applied = no limit [OK]

Hint: Define limiter and apply middleware to enforce it [OK]

Common Mistakes:

• Thinking perSecond is required instead of perMinute
• Assuming by() must use user ID always
• Believing RateLimiter::for is deprecated

5. You want to create a rate limiter in Laravel that allows 10 requests per minute per user, but if the user is an admin, allow 100 requests per minute. Which code correctly implements this?

hard

A. RateLimiter::for('custom', function (Request $request) { return $request->user()?->isAdmin() ? Limit::perMinute(100)->by($request->user()->id) : Limit::perMinute(10)->by($request->user()->id); });

B. RateLimiter::for('custom', fn(Request $request) => Limit::perMinute(10));

C. RateLimiter::for('custom', function (Request $request) { if ($request->user()->isAdmin()) { return Limit::perMinute(10); } else { return Limit::perMinute(100); } });

D. RateLimiter::for('custom', fn(Request $request) => Limit::perMinute($request->user()->isAdmin() ? 10 : 100));

Solution

1. Step 1: Check conditional logic for admin and normal users

   Admins get 100 requests/min, others get 10 requests/min, keyed by user ID.

2. Step 2: Verify correct use of ternary and by() method

   RateLimiter::for('custom', function (Request $request) { return $request->user()?->isAdmin() ? Limit::perMinute(100)->by($request->user()->id) : Limit::perMinute(10)->by($request->user()->id); }); uses ternary to select limit and keys by user ID, handling null user safely.

3. Final Answer:

   RateLimiter::for('custom', function (Request $request) { return $request->user()?->isAdmin() ? Limit::perMinute(100)->by($request->user()->id) : Limit::perMinute(10)->by($request->user()->id); }); -> Option A

4. Quick Check:

   Conditional limits with by(user ID) = RateLimiter::for('custom', function (Request $request) { return $request->user()?->isAdmin() ? Limit::perMinute(100)->by($request->user()->id) : Limit::perMinute(10)->by($request->user()->id); }); [OK]

Hint: Use ternary inside RateLimiter::for with by(user id) [OK]

Common Mistakes:

• Swapping admin and user limits
• Not keying limits by user ID
• Using wrong ternary logic or missing by()