How do you design advanced Rate Limiting with Laravel's RateLimiter class?

Short answer

Define custom limits in AppServiceProvider with RateLimiter::for(), set requests per minute based on IP or user, and apply them with throttle:name.

Explanation

Protecting an API from abuse and Brute Force attacks requires request limits. Laravel RateLimiter supports flexible limits; for example, you can allow subscribers 1000 requests per minute and free users 60, return standard X-RateLimit-Limit and X-RateLimit-Remaining headers, and automatically respond with 429 Too Many Requests when the limit is exceeded.

Code example

RateLimiter::for('api', function (Request $request) {
    return $request->user()?->isVip()
        ? Limit::none()
        : Limit::perMinute(60)->by($request->user()?->id ?: $request->ip());
});

Common mistakes

• Limiting registered users by IP alone, unfairly affecting users on shared company or university networks.

Follow-up questions

• How do you isolate validation and authorization logic in Laravel Form Request classes?

Sources

• Laravel docs — Rate Limiting