How to Fix Missing Rate Limiting in Laravel

The Problem

How to Fix

1. 1

   Define rate limiters in your application

   In Laravel 11+, configure rate limiters in bootstrap/app.php or a service provider. In AppServiceProvider boot():

   use Illuminate\Cache\RateLimiting\Limit;
   use Illuminate\Support\Facades\RateLimiter;

   public function boot(): void
   {
       RateLimiter::for('login', function (\Illuminate\Http\Request $request) {
           return Limit::perMinute(5)->by($request->ip());
       });

   RateLimiter::for('api', function (\Illuminate\Http\Request $request) {
           return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip());
       });

   RateLimiter::for('contact', function (\Illuminate\Http\Request $request) {
           return Limit::perMinute(3)->by($request->ip());
       });
   }

2. 2

   Apply rate limiting to routes

   Add the throttle middleware to your routes:

   // Login routes
   Route::post('/login', [AuthController::class, 'login'])
       ->middleware('throttle:login');

   Route::post('/forgot-password', [PasswordController::class, 'forgot'])
       ->middleware('throttle:login');

   // API routes
   Route::middleware(['auth:sanctum', 'throttle:api'])->group(function () {
       Route::get('/user', fn () => auth()->user());
       // ... other API routes
   });

   // Contact form
   Route::post('/contact', [ContactController::class, 'submit'])
       ->middleware('throttle:contact');

3. 3

   Add rate limiting response headers

   Laravel automatically includes rate limit headers in responses when using the throttle middleware:

   X-RateLimit-Limit: 60
   X-RateLimit-Remaining: 59
   Retry-After: 60 (when limit is exceeded)

   Customize the response when the limit is exceeded:

   RateLimiter::for('api', function (Request $request) {
       return Limit::perMinute(60)
           ->by($request->user()?->id ?: $request->ip())
           ->response(function (Request $request, array $headers) {
               return response()->json([
                   'message' => 'Too many requests. Please try again later.',
               ], 429, $headers);
           });
   });

How to Verify

for i in {1..10}; do curl -s -o /dev/null -w "%{http_code}\n" -X POST https://yourdomain.com/login -d "email=test@test.com&password=wrong"; done

Prevention

Frequently Asked Questions