security Junior

What is rate limiting?

Short Answer

Rate limiting restricts the number of requests a client can make in a given time period, protecting against abuse and DDoS attacks.

Detailed Answer

Rate limiting controls request frequency: Laravel provides: 1. RateLimiter facade for defining limits 2. throttle middleware for applying limits 3. Per-user and per-IP limiting 4. Custom rate limiters 5. Response headers (X-RateLimit-Remaining, Retry-After) Types: - Per-minute: 60 requests per minute per user - Per-second: Burst limiting for APIs - Per-endpoint: Different limits for different routes - Sliding window: More accurate than fixed windows Benefits: Prevents abuse, ensures fair usage, protects server resources, enables tiered API access.

Code Example

Example

<?php
// In AppServiceProvider boot()
use Illuminate\Routing\RateLimiter;
use Illuminate\Http\Requests\Request;
use Illuminate\Support\Facades\Cache;

RateLimiter::for('api', function (Request $request) {
    return Limit::perMinute(60)->by(
        $request->user()?->id ?: $request->ip()
    );
});

RateLimiter::for('login', function (Request $request) {
    return Limit::perMinute(5)->by($request->input('email'));
});

// Apply to routes
Route::middleware('throttle:api')->group(function () {
    Route::apiResource('posts', PostController::class);
});

Route::post('/login', [AuthController::class, 'login'])
    ->middleware('throttle:login');

// Response headers automatically included:
// X-RateLimit-Remaining: 59
// X-RateLimit-Limit: 60
// Retry-After: 60

What is rate limiting?

Short Answer

Detailed Answer

Code Example

Interview Tip