Rate limiting
Rate limits bound abusive request frequency.
What it is
Rate limits bound abusive request frequency.
When to use it
Protect login and expensive or sensitive operations.
Syntax
Route::post("/login", [AuthController::class, "store"])->middleware("throttle:5,1");Example
RateLimiter::for("transfers", fn (Request $request) =>
Limit::perMinute(10)->by($request->user()?->id ?? $request->ip())
);
Route::post("/transfers", [TransferController::class, "store"])
->middleware(["auth", "throttle:transfers"]);Common mistakes
IP-only limits can affect shared networks; rate limiting is not idempotency or authorization.