Weave Code
Laravel Sliding Window Limiter Laravel Package
beyondcode/laravel-sliding-window-limiter
A drop-in extension for Laravel's RateLimiter that adds sliding window rate limiting. Instead of fixed intervals that reset abruptly, throttling rolls continuously, giving smoother, more accurate limits for APIs, queued jobs, and other rate-limited actions.
Sliding window rate limiting for Laravel and Redis
Frequently asked questions about Laravel Sliding Window Limiter
- What is beyondcode/laravel-sliding-window-limiter?
- It is a Composer package that extends Laravel's RateLimiter with sliding window rate limiting backed by Redis. Instead of fixed intervals that reset abruptly, it rolls throttling continuously across a moving interval. It is intended for APIs, queued jobs, and other rate-limited actions in Laravel applications.
- How do I install beyondcode/laravel-sliding-window-limiter?
- Installation is via Composer using the package name beyondcode/laravel-sliding-window-limiter, then registering the service provider where package discovery is not available. You also need an existing Redis connection and route middleware or limiter configuration for the actions you want to throttle. Because the package is archived, expect dependency resolution issues on modern Laravel and PHP versions.
- Does this package support Laravel 10, 11, or 12?
- There is no evidence that it supports Laravel 10, 11, or 12. The package dates to the Laravel 5.8/6.x and PHP 7.x era, with its last release in September 2019. On a current stack it will likely fail Composer dependency resolution against modern illuminate/* constraints and PHP 8.x.
- Is beyondcode/laravel-sliding-window-limiter still maintained?
- No. The repository is archived, the last release was September 2019, and it has no active maintainer or security response path. That matters because a rate limiter sits on the hot path of every request and acts as a security control. Treat it as a reference implementation rather than a dependable production dependency.
- How does sliding window rate limiting differ from Laravel's fixed window RateLimiter?
- Laravel's stock fixed-window throttling can allow roughly a two-times burst around a window boundary because the counter resets abruptly. A sliding window paces traffic smoothly across a rolling interval, giving more accurate limits. The package adds that behavior as an extension to Laravel's existing RateLimiter abstraction.
- What Redis setup does the sliding window limiter require?
- It requires Redis as the shared backend and fits a single-region Laravel monolith or small fleet behind one Redis primary. It is not the right shape for multi-region or multi-service enforcement, which is better handled by an API gateway policy. A precise sliding-window log stores entries in Redis sorted sets, so memory scales with the limit and key cardinality.
- Is this package safe for production rate limiting?
- It carries high technical risk for production use. The package is archived with no security escalation path, and its documentation does not confirm the atomicity model, clock assumptions, or TTL behavior. Rate limiting is a security control on every request, so sourcing it from an abandoned package is a poor fit for a current Laravel application.
- What are the alternatives to this package for Laravel rate limiting?
- Laravel's native Redis::throttle() is sorted-set based and effectively sliding, and it may already clear the bar without an extra dependency. You can also build a small internal limiter around Redis with Lua for atomic check-and-record behavior. For multi-region or multi-service estates, enforce limits at the API gateway instead.
- Can I use it for APIs and queued jobs?
- Conceptually yes: it is designed for APIs, queued jobs, and other rate-limited actions in Laravel, typically driven by route middleware and Laravel's RateLimiter abstraction. In practice, its abandoned lifecycle limits it to legacy Laravel 5.8/6.x applications with a bounded remaining lifespan. For modern applications, borrow the approach rather than adopting the package.
- How should I test or evaluate it before adopting it?
- Test concurrency against the configured limit to confirm atomic check-and-record behavior, then verify TTL handling, clock skew assumptions, Retry-After and X-RateLimit headers, and Redis memory under realistic key cardinality. Compare it with Laravel's native Redis::throttle() in staging before committing. If you fork it, assign a named maintainer and add tests for boundary behavior and fail-open versus fail-closed decisions.
Weaver
How can I help you explore Laravel packages today?