Rate limiting in Laravel - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to apply a rate limit of 60 requests per minute to a route.

Laravel

Route::middleware('throttle:[1]')->group(function () {
    Route::get('/api/data', function () {
        return response()->json(['message' => 'Success']);
    });
});

Drag options to blanks, or click blank then click option'

A60,1

B60

C1,60

Dthrottle

Attempts:

3 left

💡 Hint

Common Mistakes

Using only one number instead of two separated by a comma.

Swapping the order of numbers (minutes first instead of requests).

The throttle middleware accepts a string like '60,1' which means 60 requests per 1 minute.

2fill in blank

medium

Complete the code to create a custom rate limiter named 'uploads' allowing 10 requests per minute.

Laravel

use Illuminate\Support\Facades\RateLimiter;

RateLimiter::for('uploads', function ([1] $request) {
    return Limit::perMinute(10);
});

Drag options to blanks, or click blank then click option'

ARequest

BRequestHandler

CHttpRequest

DRequestData

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect class names like RequestHandler or HttpRequest.

Not importing the Request class.

The closure receives an instance of Illuminate\Http\Request, so the parameter type is Request.

3fill in blank

hard

Fix the error in the code to limit requests by user ID instead of IP address.

Laravel

RateLimiter::for('api', function (Request $request) {
    return Limit::perMinute(100)->by($request->[1]());
});

Drag options to blanks, or click blank then click option'

Auser_id

Buser()->id

Cip

Duser

Attempts:

3 left

💡 Hint

Common Mistakes

Using $request->ip() limits by IP, not user.

Using 'user' or 'user_id' as method names causes errors.

To limit by user ID, you call $request->user()->id to get the authenticated user's ID.

4fill in blank

hard

Fill both blanks to create a rate limiter that limits 5 requests per minute per user email.

Laravel

RateLimiter::for('email_limit', function (Request $request) {
    return Limit::perMinute([1])->by($request->user()->[2]);
});

Drag options to blanks, or click blank then click option'

A5

Bemail

Cid

D10

Attempts:

3 left

💡 Hint

Common Mistakes

Using 10 instead of 5 for the limit.

Using 'id' instead of 'email' for the user property.

The limit is 5 requests per minute, and the key is the user's email.

5fill in blank

hard

Fill all three blanks to define a rate limiter that allows 20 requests per minute per user IP or user ID fallback.

Laravel

RateLimiter::for('complex_limit', function (Request $request) {
    return Limit::perMinute([1])->by($request->ip() ?: $request->user()->[2] ?? $request->[3]());
});

Drag options to blanks, or click blank then click option'

A20

Bid

Cip

Demail

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'email' instead of 'id' for user property.

Using wrong method names for IP.

The limit is 20 requests per minute. It tries to identify by IP first, then user ID, then IP method fallback.

Practice

1. What is the main purpose of rate limiting in Laravel applications?

easy

A. To speed up database queries automatically

B. To generate API tokens for users

C. To encrypt user passwords securely

D. To control how often users can make requests to keep the app stable

Solution

1. Step 1: Understand the concept of rate limiting

   Rate limiting is used to limit the number of requests a user can make in a given time to prevent overload.

2. Step 2: Identify the purpose in Laravel context

   Laravel uses rate limiting to keep the app stable by controlling request frequency.

3. Final Answer:

   To control how often users can make requests to keep the app stable -> Option D

4. Quick Check:

   Rate limiting = control request frequency [OK]

Hint: Rate limiting controls request frequency to protect apps [OK]

Common Mistakes:

• Confusing rate limiting with database optimization
• Thinking it encrypts data
• Assuming it generates tokens

2. Which of the following is the correct way to define a rate limiter in Laravel using RateLimiter::for?

easy

A. RateLimiter::limit('api', 60);

B. RateLimiter::for('api', fn (Request $request) => Limit::perMinute(60));

C. RateLimiter::set('api', 60);

D. RateLimiter::create('api', 60);

Solution

1. Step 1: Recall Laravel rate limiter syntax

   Laravel uses RateLimiter::for with a closure returning a Limit object.

2. Step 2: Match the correct syntax

   RateLimiter::for('api', fn (Request $request) => Limit::perMinute(60)); correctly uses RateLimiter::for with a closure and Limit::perMinute(60).

3. Final Answer:

   RateLimiter::for('api', fn (Request $request) => Limit::perMinute(60)); -> Option B

4. Quick Check:

   Correct syntax uses RateLimiter::for + Limit::perMinute [OK]

Hint: Use RateLimiter::for with a closure returning Limit [OK]

Common Mistakes:

• Using non-existent methods like set or create
• Passing number directly without Limit::perMinute
• Missing the closure function

3. Given this route definition in Laravel:

Route::middleware('throttle:api')->get('/data', function () { return 'OK'; });

If the rate limiter 'api' allows 2 requests per minute, what will happen on the 3rd request within the same minute?

medium

A. The request will be blocked with a 429 Too Many Requests response

B. The request will succeed and return 'OK'

C. The request will cause a server error 500

D. The request will be queued and delayed

Solution

1. Step 1: Understand the throttle middleware behavior

   The throttle middleware limits requests based on the named limiter, here 'api'.

2. Step 2: Apply the limit of 2 requests per minute

   After 2 requests, the 3rd request exceeds the limit and is blocked with a 429 error.

3. Final Answer:

   The request will be blocked with a 429 Too Many Requests response -> Option A

4. Quick Check:

   Exceed limit = 429 error [OK]

Hint: Requests over limit get 429 error response [OK]

Common Mistakes:

• Assuming requests always succeed
• Thinking server error 500 occurs
• Believing requests get queued automatically

4. Consider this Laravel rate limiter definition:

RateLimiter::for('login', function (Request $request) { return Limit::perMinute(5)->by($request->ip()); });

What is wrong if users report they can make unlimited login attempts?

medium

A. The RateLimiter::for method is deprecated

B. The Limit::perMinute(5) should be Limit::perSecond(5)

C. The limiter is not applied on the login route middleware

D. The by() method should use user ID instead of IP

Solution

1. Step 1: Check if limiter is applied on route

   Defining a limiter alone does not enforce it; middleware must use 'throttle:login'.

2. Step 2: Identify missing middleware usage

   If middleware is missing on login route, rate limiting won't work, allowing unlimited attempts.

3. Final Answer:

   The limiter is not applied on the login route middleware -> Option C

4. Quick Check:

   Limiter defined but not applied = no limit [OK]

Hint: Define limiter and apply middleware to enforce it [OK]

Common Mistakes:

• Thinking perSecond is required instead of perMinute
• Assuming by() must use user ID always
• Believing RateLimiter::for is deprecated

5. You want to create a rate limiter in Laravel that allows 10 requests per minute per user, but if the user is an admin, allow 100 requests per minute. Which code correctly implements this?

hard

A. RateLimiter::for('custom', function (Request $request) { return $request->user()?->isAdmin() ? Limit::perMinute(100)->by($request->user()->id) : Limit::perMinute(10)->by($request->user()->id); });

B. RateLimiter::for('custom', fn(Request $request) => Limit::perMinute(10));

C. RateLimiter::for('custom', function (Request $request) { if ($request->user()->isAdmin()) { return Limit::perMinute(10); } else { return Limit::perMinute(100); } });

D. RateLimiter::for('custom', fn(Request $request) => Limit::perMinute($request->user()->isAdmin() ? 10 : 100));

Solution

1. Step 1: Check conditional logic for admin and normal users

   Admins get 100 requests/min, others get 10 requests/min, keyed by user ID.

2. Step 2: Verify correct use of ternary and by() method

   RateLimiter::for('custom', function (Request $request) { return $request->user()?->isAdmin() ? Limit::perMinute(100)->by($request->user()->id) : Limit::perMinute(10)->by($request->user()->id); }); uses ternary to select limit and keys by user ID, handling null user safely.

3. Final Answer:

   RateLimiter::for('custom', function (Request $request) { return $request->user()?->isAdmin() ? Limit::perMinute(100)->by($request->user()->id) : Limit::perMinute(10)->by($request->user()->id); }); -> Option A

4. Quick Check:

   Conditional limits with by(user ID) = RateLimiter::for('custom', function (Request $request) { return $request->user()?->isAdmin() ? Limit::perMinute(100)->by($request->user()->id) : Limit::perMinute(10)->by($request->user()->id); }); [OK]

Hint: Use ternary inside RateLimiter::for with by(user id) [OK]

Common Mistakes:

• Swapping admin and user limits
• Not keying limits by user ID
• Using wrong ternary logic or missing by()