laravel-rate-limiting

Configure per-user and per-route rate limits in Laravel with throttle middleware.

Updated Jun 8, 2025

Search Tags:#security #api #backend #middleware #laravel #rate-limiting #throttle

Ready to run

npx skills add https://github.com/noartem/kawa --skill laravel-rate-limiting-noartem

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: laravel-rate-limiting
Source: https://github.com/noartem/kawa/tree/main/ui/.ai/skills/laravel-rate-limiting
Command: npx skills add https://github.com/noartem/kawa --skill laravel-rate-limiting-noartem

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Protect APIs from abuse by enforcing per-user and per-route rate limits, ensuring fair access and improved stability.

Core Features & Use Cases

Scope limits by user when authenticated and fall back to IP-based identification to prevent abuse while preserving user experience
Communicate current limits and reset times to clients via standard headers
Provide clear 429 responses with retry hints and backoffs
Apply specialized limiters to bursty endpoints to avoid hotspots

Quick Start

Configure a named rate limiter for the API and apply the throttle:api middleware to your Laravel routes.

Frequently Asked Questions about laravel-rate-limiting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I set up per-user rate limiting in a Laravel API?▼

Configure per-user rate limiting in Laravel by defining a RateLimiter::for limiter and applying the throttle:api middleware to your routes. It scopes limits by authenticated user and falls back to IP identification to prevent abuse.

How do I prevent API abuse on high-traffic Laravel endpoints without hurting UX?▼

Prevent API abuse on high-traffic Laravel endpoints by applying specialized named limiters to bursty routes. This restricts usage per user and per route while preserving UX through clear 429 responses with retry hints and backoffs.

Can I communicate API rate limits to clients using HTTP headers in Laravel?▼

Yes, you can communicate API rate limits to clients using HTTP headers in Laravel. This approach outputs standard headers that convey current limit thresholds and reset times to clients directly from the throttle middleware.

How does Laravel handle rate limiting for unauthenticated API requests?▼

Laravel handles rate limiting for unauthenticated API requests by falling back to IP-based identification. This ensures the throttle middleware continues restricting access per route to prevent abuse when user authentication is absent.

Does the Laravel throttle middleware support 429 responses with retry hints?▼

Yes, the Laravel throttle middleware supports 429 responses with retry hints. It provides clear HTTP 429 status codes and backoff information, ensuring clients receive explicit feedback on when to retry blocked API requests.