How to implement a Rate Limiter for a route in Laravel

In Laravel, you can implement rate limiting for routes using built-in middleware. Rate limiting helps protect your application by limiting the number of requests a user can make to your routes within a given timeframe. Here’s how you can set up and configure a rate limiter for a route in Laravel.

Step 1: Configure Rate Limiting in RouteServiceProvider

In Laravel, you can define rate limiters in the RouteServiceProvider. Open the app/Providers/RouteServiceProvider.php file and define your rate limiters within the configureRateLimiting method:

namespace App\Providers;

use Illuminate\Foundation\Support\Providers\RouteServiceProvider as ServiceProvider;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\RateLimiter;

class RouteServiceProvider extends ServiceProvider
{
    // Other methods...

    protected function configureRateLimiting()
    {
        RateLimiter::for('global', function (Request $request) {
            return Limit::perMinute(60);
        });

        RateLimiter::for('api', function (Request $request) {
            return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip());
        });

        RateLimiter::for('custom', function (Request $request) {
            return Limit::perMinute(10)->response(function () {
                return response('Too Many Requests', 429);
            });
        });
    }
}

Step 2: Apply Rate Limiter to Routes

Once you have defined your rate limiters, you can apply them to your routes. You can do this in your route files, such as routes/web.php or routes/api.php.

Example for Web Routes

use Illuminate\Support\Facades\Route;

Route::middleware('throttle:global')->group(function () {
    Route::get('/home', 'HomeController@index');
    // Other routes...
});

Route::middleware('throttle:custom')->group(function () {
    Route::post('/comments', 'CommentController@store');
});

Example for API Routes

use Illuminate\Support\Facades\Route;

Route::middleware('throttle:api')->group(function () {
    Route::get('/user', 'UserController@show');
    Route::post('/posts', 'PostController@store');
});

Step 3: Customize Rate Limiting Responses

You can customize the response when the rate limit is exceeded. This is done using the response method in the rate limiter definition.

RateLimiter::for('custom', function (Request $request) {
    return Limit::perMinute(10)->response(function () {
        return response()->json([
            'message' => 'You have exceeded the rate limit. Please try again later.'
        ], 429);
    });
});

Step 4: Testing Rate Limiting

To test the rate limiting, you can use tools like Postman or cURL to send multiple requests to your routes and observe the response when the rate limit is exceeded.

Using cURL

for i in {1..12}; do curl -X POST http://your-app.test/comments; done

Using Postman

1. Open Postman and create a new request.
2. Set the method and URL for your route.
3. Send multiple requests and observe the rate limiting behavior.

Step 5: Using Dynamic Rate Limiting

You can also set rate limits dynamically based on user roles or other criteria.

RateLimiter::for('dynamic', function (Request $request) {
    if ($request->user()->isAdmin()) {
        return Limit::none();
    }

    return Limit::perMinute(20)->by($request->user()?->id ?: $request->ip());
});

Apply the dynamic rate limiter to your routes:

Route::middleware('throttle:dynamic')->group(function () {
    Route::get('/dashboard', 'DashboardController@index');
});

Conclusion

By following these steps, you can implement rate limiting for your routes in Laravel to protect your application from abuse and ensure fair usage of your resources. The built-in rate limiting middleware makes it easy to configure and apply different rate limits based on your application's needs. For more advanced rate limiting options, refer to the official Laravel documentation.