How Laravel Throttle works

Laravel Throttle: Learn how it works and see an example of its usage to limit requests and protect your app.

Laravel Throttle is a feature in the Laravel PHP framework that allows developers to restrict the speed and frequency of requests to an application. This is useful for preventing denial of service (DoS) attacks, or to limit the number of requests from a single user. Throttling can be configured to allow certain users or groups of users to be exempt from throttling.

For example, let's say we have a web application that is used to track the progress of a project. We want to ensure that users can only make a certain number of requests per hour. Here is how we might set up throttling in Laravel:

Step 1: Install the Throttle Package

First, we need to install the Throttle package. This can be done with Composer:

composer require laravel/throttle

Once the package is installed, we need to add it to the providers array in our config/app.php file:

'providers' => [
    // ...
    LaravelThrottleThrottleServiceProvider::class,
],

Next, we need to add the throttle middleware to our application. This can be done in the app/Http/Kernel.php file:

protected $middlewareGroups = [
    // ...
    'throttle' => LaravelThrottleHttpMiddlewareThrottleRequests::class,
],

Step 2: Configure the Throttle Settings

Next, we need to configure the throttle settings. This can be done in the config/throttle.php file. Here we can set the maximum number of requests allowed per hour, how long the throttle should last, and which users or groups of users should be exempt from throttling.

return [

    /*
    |--------------------------------------------------------------------------
    | Throttle Settings
    |--------------------------------------------------------------------------
    |
    | Here you may configure the throttle settings for your application.
    |
    | You can set different throttle settings for various user roles or
    | you can apply the same throttle settings to all users.
    |
    */

    'throttles' => [
        'global' => [
            'max_requests' => 100,
            'duration'     => 3600,
            'groups'       => [],
        ],

        'users' => [
            'max_requests' => 50,
            'duration'     => 3600,
            'groups'       => ['admin'],
        ],
    ],

];

Step 3: Add Throttle Middleware to Routes

Finally, we need to add the throttle middleware to the routes we want to protect. This can be done in the routes/web.php file:

Route::middleware('throttle:global,50,1')->group(function () {
    // Routes that are protected by throttling
    Route::get('/projects', 'ProjectController@index');
});

In this example, we are protecting the /projects route with the global throttle settings. This means that all users will be limited to 50 requests per hour. We can also specify different throttle settings for specific users or groups of users. This is done by using the 'users' throttle setting instead of the 'global' setting.

Once the throttling is set up, any requests that exceed the limit will be blocked and the user will receive an error message. This is a great way to protect your application from DoS attacks and to limit the number of requests from a single user.