php 79 lines · 2 tabs

Laravel rate limiting for API protection

Carlos Mendez Jan 2026

2 tabs

<?php

namespace App\Providers;

use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Foundation\Support\Providers\RouteServiceProvider as ServiceProvider;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\RateLimiter;

class RouteServiceProvider extends ServiceProvider
{
    protected function configureRateLimiting(): void
    {
        // Default API rate limit
        RateLimiter::for('api', function (Request $request) {
            return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip());
        });

        // Custom rate limit for login
        RateLimiter::for('login', function (Request $request) {
            return Limit::perMinute(5)->by($request->ip());
        });

        // Different rates for authenticated vs guest
        RateLimiter::for('posts', function (Request $request) {
            return $request->user()
                ? Limit::perMinute(100)->by($request->user()->id)
                : Limit::perMinute(10)->by($request->ip());
        });

        // Multiple limits - whichever is hit first
        RateLimiter::for('strict', function (Request $request) {
            return [
                Limit::perMinute(10),
                Limit::perHour(100),
            ];
        });

        // Custom response
        RateLimiter::for('uploads', function (Request $request) {
            return Limit::perMinute(5)
                ->by($request->user()->id)
                ->response(function (Request $request, array $headers) {
                    return response('Too many uploads', 429, $headers);
                });
        });
    }
}

<?php

use Illuminate\Support\Facades\Route;

// Apply default API rate limit
Route::middleware(['throttle:api'])->group(function () {
    Route::get('/posts', [PostController::class, 'index']);
});

// Custom rate limiter
Route::middleware(['throttle:posts'])->group(function () {
    Route::post('/posts', [PostController::class, 'store']);
});

// Login with strict limit
Route::post('/login', [AuthController::class, 'login'])
    ->middleware('throttle:login');

// Manual rate limiting in controller
Route::post('/upload', function (Request $request) {
    if (RateLimiter::tooManyAttempts('upload:' . $request->user()->id, 5)) {
        $seconds = RateLimiter::availableIn('upload:' . $request->user()->id);
        return response('Too many requests', 429, [
            'Retry-After' => $seconds,
        ]);
    }

    RateLimiter::hit('upload:' . $request->user()->id, 60);

    // Process upload...
});

2 files · php Explain with highlit

Rate limiting prevents API abuse by restricting request frequency per user or IP. Laravel's RateLimiter facade defines limits in RouteServiceProvider. I apply limiters via middleware—throttle:api for the default API limiter. Custom limiters use closures returning Limit objects with max attempts and decay time. Named limiters enable different rates for different endpoints. The for() method creates per-user limits, while static limits apply globally. Headers like X-RateLimit-Remaining inform clients of remaining attempts. Exceeded limits return 429 responses. For advanced scenarios, I integrate Redis for distributed rate limiting across servers. This protection is essential for public APIs and prevents resource exhaustion attacks.

Related snips

ruby

payload = {
  sub: user.id,
  iss: 'https://auth.example.com',
  aud: 'codesnips-api',
  exp: 15.minutes.from_now.to_i,
  iat: Time.now.to_i,

JWT issuance and verification without common footguns

jwt authentication api

by Kai Nakamura 2 tabs

ruby

module Api
  module V1
    class UsersController < BaseController
      def show
        user = User.includes(:profile).find(params[:id])

ETags for conditional requests and caching

rails caching http-caching

by Alex Kumar 1 tab

graphql

type User {
    id: ID!
    name: String!
    email: String!
    posts: [Post!]!
    createdAt: String!

GraphQL API with Spring Boot

java graphql spring-boot

by David Kumar 3 tabs

typescript

export type Settled<R> =
  | { status: 'fulfilled'; value: R }
  | { status: 'rejected'; reason: unknown };

export interface ConcurrencyOptions {
  limit: number;

Simple concurrency limiter for batch operations

node concurrency async

by codesnips 2 tabs

bash

#!/usr/bin/env bash
set -euo pipefail

export VAULT_ADDR="https://vault.internal:8200"
export VAULT_TOKEN="${VAULT_TOKEN:?missing VAULT_TOKEN}"

Secrets management with environment isolation and Vault

secrets-management vault environment-variables

by Kai Nakamura 1 tab

php

<?php

namespace App\Providers;

use App\Contracts\PaymentGateway;
use App\Services\StripePaymentGateway;

Laravel service container and dependency injection

laravel dependency-injection service-container

by Carlos Mendez 2 tabs

Share this code

Here's the card — post it anywhere.

Laravel rate limiting for API protection — share card

Link copied