- What is maba/gentle-force used for in Laravel?
- maba/gentle-force is a Laravel package for configurable rate limiting and brute-force protection. You define named limiters with request quotas and decay windows, then apply them through middleware to routes or route groups. It is aimed at protecting APIs, login endpoints, password reset flows, and other sensitive actions from abuse.
- How do I install maba/gentle-force?
- Install it with Composer using composer require maba/gentle-force. Register the package middleware in your Laravel HTTP kernel or apply it directly to routes, and publish or adjust the package configuration if your setup requires it. Then choose a cache store and define the named limiters your routes will use.
- Does maba/gentle-force support Laravel 10 and Laravel 11?
- The last release was August 2021, during the Laravel 8 era with PHP 7.x and PHP 8.0-era constraints. Support for Laravel 9, 10, and 11 with PHP 8.2+ is not verified in the provided context, so treat it as a compatibility spike. Install it against your exact Laravel and PHP matrix before adopting, and be prepared to fork or vendor it if Composer constraints block installation.
- How do I define named limiters and apply them to routes?
- The package lets you define named limiters with request quotas and decay windows, then apply them through middleware to individual routes or route groups. Configure the limiters in the published configuration, attach the middleware where protection is needed, and choose a key resolver for the request identity. Keep thresholds route-specific so login, password reset, and API endpoints have appropriate quotas.
- Can I use custom key resolvers for IP or authenticated users?
- Yes. maba/gentle-force supports custom key resolvers so limits can be scoped by IP address, authenticated user, or an application-specific identifier. Choose a resolver that matches the abuse model for each route and ensure the resulting key is stable across requests and application nodes.
- Which cache store should I use for distributed rate limiting?
- Counters are cache-backed, so a shared and atomic store such as Redis or Memcached is the safe choice for multi-node deployments. Database caching can distort thresholds under load because atomic increments and TTL behavior vary. For single-server applications the default cache may be acceptable, but document the semantics before production.
- How does maba/gentle-force compare with Laravel's native RateLimiter and throttle middleware?
- Laravel's native RateLimiter and throttle middleware are the idiomatic first-party primitives for request limiting, while maba/gentle-force adds its own named limiter and attempt-tracking layer. The package is adjacent to, not built on, native limiting, so running both can double-count or conflict if applied to the same routes. Use one mechanism per route and adopt gentle-force only where its brute-force or error-throttling behavior adds clear value.
- What happens when a request exceeds the limit, and can I customize the response?
- When a request exceeds its configured quota, the middleware triggers throttling behavior and integrates with Laravel's exception handling to return a clear throttling response. The overview notes configurable throttling responses, so review the published configuration and confirm the status code, body, and Retry-After headers match your API contract. Validate the behavior on a test route before relying on it for authentication endpoints.
- Does maba/gentle-force have tests, CI, and recent maintenance?
- The provided technical assessment does not confirm a public test suite or CI status, and the last release is from August 2021. With zero dependents and 43 stars, there is little external production validation to surface regressions. Before adoption, inspect the repository for tests and CI, then add your own integration tests around the routes you protect.
- Is maba/gentle-force safe for production authentication endpoints, and what should I check first?
- It can be a reasonable fit for a Laravel 7 or 8-era application that wants configuration-driven brute-force protection, but it carries high maintenance and security-sensitive risk. Gate adoption on a compatibility spike against your exact Laravel and PHP versions, verify behavior with Redis and your database cache driver, and define a fail-open versus fail-closed policy. Run it behind a feature flag or in log-only mode on non-critical routes before enforcing blocks, and be prepared to fork and own patches.