Rate limiting in Laravel - Step-by-Step Execution

Concept Flow - Rate limiting

Request Received

↓

Check Rate Limit

↓

Reject

↓

Send 429

↓

Update Count

When a request comes in, Laravel checks if the user has exceeded the allowed number of requests. If yes, it rejects with a 429 error. Otherwise, it processes the request and updates the count.

Execution Sample

Laravel

Route::middleware('throttle:3,1')->get('/api/data', function () {
    return response()->json(['message' => 'Success']);
});

This code limits the API route to 3 requests per 1 minute per user.

Execution Table

Request Number	Requests in Last Minute	Condition (< 3?)	Action	Response
1	0	Yes	Allow and count request	200 Success
2	1	Yes	Allow and count request	200 Success
3	2	Yes	Allow and count request	200 Success
4	3	No	Reject request	429 Too Many Requests
5	3	No	Reject request	429 Too Many Requests
After 1 minute passes	0	Yes	Allow and reset count	200 Success

💡 Requests exceeding 3 in 1 minute are rejected with 429 error until time window resets.

Variable Tracker

Variable	Start	After Req 1	After Req 2	After Req 3	After Req 4	After 1 min
requests_count	0	1	2	3	3	0

Key Moments - 2 Insights

Why does the 4th request get rejected even though it is close in time to the 3rd?

Because the limit is 3 requests per 1 minute, the 4th request exceeds this limit as shown in execution_table row 4, so Laravel rejects it with a 429 response.

What happens to the request count after 1 minute?

After 1 minute, the count resets to 0 as shown in variable_tracker and execution_table row 6, allowing new requests to be accepted again.

Visual Quiz - 3 Questions

Look at the execution table, what is the response for the 3rd request?

A 429 Too Many Requests

B 500 Server Error

C 200 Success

D 404 Not Found

💡 Hint

Check the 'Response' column for Request Number 3 in the execution_table.

At which request number does the condition 'Requests in Last Minute < 3' become false?

A Request 2

B Request 4

C Request 3

D Request 5

💡 Hint

Look at the 'Condition' column in the execution_table to find when it changes to 'No'.

If the limit was changed to 5 requests per minute, how would the response for Request 4 change?

A It would be 200 Success

B It would be 429 Too Many Requests

C It would be 404 Not Found

D It would be 500 Server Error

💡 Hint

Consider the 'requests_count' variable and the new limit compared to execution_table rows.

Concept Snapshot

Laravel Rate Limiting:
- Use 'throttle:X,Y' middleware to limit X requests per Y minutes.
- Requests exceeding limit get 429 error.
- Count resets after time window.
- Helps protect APIs from overload.
- Easy to apply on routes or controllers.

Full Transcript

Rate limiting in Laravel controls how many requests a user can make in a set time. When a request arrives, Laravel checks if the user has made too many requests recently. If the user is within the limit, the request is allowed and counted. If the user exceeds the limit, Laravel rejects the request with a 429 Too Many Requests error. The count resets after the time window passes, allowing new requests. This protects your app from too many requests at once. The example code uses 'throttle:3,1' to allow 3 requests per 1 minute. The execution table shows requests 1 to 3 succeed, request 4 and 5 are rejected, and after 1 minute the count resets and requests succeed again.