- Does indragunawan/api-rate-limit-bundle work with Laravel?
- No. This is a Symfony bundle built for API Platform resources, and it ships no Laravel service provider, no package auto-discovery, and no integration with Laravel's HTTP kernel. Its rate-limit metadata is expressed through API Platform resource definitions and Symfony DI compiler passes, neither of which has an execution path in a Laravel application. For Laravel, use the framework's built-in RateLimiter instead.
- How do I install indragunawan/api-rate-limit-bundle?
- It is installed with Composer as a Symfony bundle and registered in config/bundles.php, then configured through API Platform resource definitions. There is no config publishing step and no Laravel-style package discovery. If you are following Laravel installation docs, this package simply does not fit that workflow.
- Is this bundle compatible with API Platform 3 and Symfony 6 or 7?
- Probably not without patching. The last release was 2021-04-27, which predates API Platform 3's metadata and attribute changes, so the extension points it registers likely no longer resolve. Treat it as incompatible until you prove otherwise in a short, timeboxed spike on PHP 8.1 through 8.3.
- What is the Laravel equivalent of this rate limit bundle?
- Use Illuminate\Cache\RateLimiter with the throttle middleware. Define a named limiter in AppServiceProvider, for example RateLimiter::for('api', fn (Request $r) => Limit::perMinute(60)->by($r->user()?->id ?: $r->ip())), and apply it with throttle:api on your routes. Per-resource limits map naturally to route middleware groups rather than resource metadata.
- How do I add rate limiting per route or per client in Laravel?
- Create a named limiter keyed by whatever identity you care about, such as user ID, API key, tenant, or IP, then attach it to route groups with the throttle middleware. Laravel returns a 429 automatically when the quota is exceeded. For per-client variation, pass the limit as a middleware parameter or resolve it dynamically inside the limiter closure.
- Is indragunawan/api-rate-limit-bundle still maintained?
- There has been no release since April 2021, the project has a single maintainer, and it has zero dependents. Expect issues and pull requests to go unanswered, and expect no CVE response. It is MIT licensed, so forking is possible, but that means permanently owning the code.
- Is it safe to depend on a stale package for rate limiting in production?
- Rate limiting sits directly in the abuse-protection path, so an unmaintained dependency there is a security-posture decision rather than a routine maintenance concern. A stale limiter that silently fails open is worse than no limiter, because you believe you are protected. Prefer a first-party limiter or terminate volumetric abuse at the edge.
- Should I use edge rate limiting like Cloudflare, nginx, or an ALB instead?
- For purely volumetric abuse, yes. Edge limiting is the cheapest option, requires no application code, and removes an application-layer dependency entirely. Reserve application-level limiters, backed by Redis, for business quotas such as per-tenant plans or per-key API allowances.
- How do I return X-RateLimit and Retry-After headers in Laravel?
- Laravel's throttler does not add those headers for you, and neither does this bundle. Add a small first-party middleware that reads the limiter result and sets X-RateLimit-Limit, X-RateLimit-Remaining, and Retry-After on the response. That is roughly a few dozen lines and gives you full control over the contract.
- Can I use file or array cache for rate limiting across multiple servers?
- No. Limiter state must live in a shared store such as Redis, because in-memory or file cache breaks correctness across pods and lets each instance grant its own quota. Budget for the extra cache round-trip on every request and watch for hot keys under high cardinality. This applies equally to Laravel's RateLimiter and to any replacement you build.