- What is alt-three/throttle and how does it rate limit Laravel routes?
- Alt Three Throttle is a Laravel middleware package that limits requests per client through Laravel's cache. You attach the throttle middleware with a limit and decay window, such as throttle:60,1, and it returns a standard 429 Too Many Requests response once the cache-backed counter is exhausted. It also adds X-RateLimit-* and Retry-After response headers. The package is a Laravel 5-era implementation and the repository is archived.
- How do I install alt-three/throttle in a Laravel application?
- Install it with composer require alt-three/throttle, then register the package service provider in config/app.php if your Laravel version does not auto-discover it. Add the throttle middleware alias to your HTTP kernel and attach throttle:60,1 to routes or route groups. In practice this is only viable on Laravel 5.x with PHP 7.x, because the package was last released in September 2018 and its Composer constraints block Laravel 6+ and PHP 8.
- Which Laravel and PHP versions does alt-three/throttle support?
- The package targets Laravel 5.x and PHP 7.0-era runtimes, consistent with its last release in September 2018. It is not compatible with Laravel 6 and later or PHP 8 without forking and updating illuminate/* constraints and replacing removed helpers. For any currently supported Laravel version, use the framework's native ThrottleRequests middleware or RateLimiter facade instead.
- What cache store should I use for alt-three/throttle in production?
- Use a cache store that supports atomic increment, such as Redis or Memcached, so concurrent requests do not over-admit due to read-then-write races. File and database cache drivers are not safe for rate limiting under concurrency. Configure trusted proxies if your limiter keys are derived from client IP addresses behind a load balancer. The package relies entirely on Laravel's cache repository, so cache availability and fail-open versus fail-closed behavior must be decided explicitly.
- How does alt-three/throttle differ from Laravel's built-in rate limiting?
- Laravel now ships ThrottleRequests middleware, the RateLimiter facade, and named limiters through RateLimiter::for(), which cover the same cache-backed fixed-window limiting that alt-three/throttle provides. The package's only defensible advantage is preserving a specific limiter semantic, such as custom key derivation, per-route config arrays, or response header behavior, that native middleware does not express as cleanly. On supported Laravel versions, adopting the package adds a dependency where the framework already provides a maintained solution.
- How do I test routes protected by alt-three/throttle?
- Because the limiter is cache-backed, point the application at the array cache driver during tests and clear the cache between test cases so counters do not leak. Use Laravel's HTTP testing helpers to assert 429 responses, Retry-After, and X-RateLimit-* headers after the configured number of requests. If you need deterministic decay-window tests, freeze or travel time rather than sleeping. Always test key derivation and trusted-proxy configuration, since IP-based keys can break silently.
- Is alt-three/throttle still maintained and safe to use?
- No. The repository is archived, the last release was September 2018, and there is no security response path, CVE monitoring, or PHP 8 and Laravel 6+ compatibility work. There are zero dependents, so regressions would surface only in your own environment. The MIT license permits a fork, which is the only realistic mitigation if you must keep the package.
- What are the alternatives to alt-three/throttle for Laravel rate limiting?
- The primary alternative is Laravel's native rate limiting: ThrottleRequests middleware on 5.2+, the RateLimiter facade on 5.6+, and RateLimiter::for() named limiters on 8.x+. These are first-class, maintained, and cover per-route and per-tenant limiting. If you need custom keys or weighted costs, define a custom limiter with RateLimiter::for() rather than adding a third-party package. For a frozen Laravel 5.x application, replacement is still recommended over integration.
- How does alt-three/throttle count requests per client and route?
- The middleware builds a cache key from the route and request origin, then increments a counter within the configured decay window. Once the counter exceeds the limit, it returns 429 and includes X-RateLimit-* and Retry-After headers. Because the key is origin-derived, correct client identification behind proxies or load balancers depends on Laravel's trusted proxy configuration. The counting is fixed-window, so boundary bursts can briefly exceed the nominal limit.
- Can I use alt-three/throttle on Laravel 8, 9, 10, or 11?
- Not without a fork. The package's Composer constraints are pinned to Laravel 5.x-era illuminate/* packages and PHP 7, so composer require will fail on modern Laravel applications. Even if you loosen constraints, you would need to re-namespace code, update contracts, replace removed helpers, and revalidate against current cache and routing internals. The recommended path is to replace it with native RateLimiter::for() definitions that preserve your key derivation and response semantics.