Weave Code
Rate Limiter Laravel Package
symfony/rate-limiter
Symfony Rate Limiter provides a token bucket implementation for rate limiting input and output in PHP applications. Configure policies and storage with RateLimiterFactory, then reserve tokens to wait or consume tokens to check acceptance.
Provides a Token Bucket implementation to rate limit input and output in your application
Frequently asked questions about Rate Limiter
- How do I install symfony/rate-limiter in a Laravel application?
- Install it with composer require symfony/rate-limiter. Then create a RateLimiterFactory with a policy and storage, and call consume() or reserve() from middleware, controllers, or jobs. The package requires PHP 8.1 or newer, so confirm your Laravel runtime meets that requirement.
- Is symfony/rate-limiter compatible with Laravel 9 and Laravel 10?
- The component is compatible with Laravel 9 and newer as long as your PHP version satisfies the package's PHP 8.1+ requirement. The evaluation notes Laravel 8 compatibility with older PHP constraints, but the rate limiter itself still requires PHP 8.1+. Test your specific Laravel and PHP combination before upgrading.
- What is the difference between reserve() and consume() in symfony/rate-limiter?
- reserve() blocks and waits until the requested number of tokens is free, so it is useful when the process must run. consume() claims tokens only if they are available right now and returns an accepted or rejected result. Use consume() when you plan to skip the process rather than wait for capacity.
- Which rate limiting policies does symfony/rate-limiter support?
- It supports token bucket, fixed window, and sliding window policies. Token bucket is useful for burst-tolerant auth and payment flows, while fixed or sliding windows can fit admin dashboards and stricter quotas. CompoundRateLimiterFactory can combine limits, such as per-IP and per-user.
- How do I use Redis storage with Symfony Rate Limiter in Laravel?
- Use RedisStorage or a custom StorageInterface backed by Laravel's Redis connection so limit state is shared across processes and servers. InMemoryStorage is fine for single-process tests or prototypes but is not persistent. For high-concurrency or serverless deployments, Redis is the safer choice to avoid race conditions.
- Can I use symfony/rate-limiter in Laravel middleware and queue jobs?
- Yes. You can call consume() in Laravel middleware and return a 429 response when isAccepted() is false, or use reserve()->wait() when a process must proceed. Queue jobs can apply the same limiter before dispatching or inside handle() to throttle background work.
- What are the production concerns for symfony/rate-limiter in Laravel?
- The main production risks are non-persistent in-memory storage, concurrency races without Redis, and untested custom burst configurations. The v8.1.6 release caps burst size and computed duration, but you should still test token bucket settings under expected traffic. Also plan 429 responses, logging for audit or SOC 2 needs, and PHPStan checks if your codebase uses unserialize().
- How should I test rate limiting with symfony/rate-limiter?
- Use InMemoryStorage in unit tests and create factories with small limits so you can assert accepted and rejected consume() results. For reserve() behavior, test that wait() blocks until a token is available rather than relying on wall-clock timing in every test. Keep Redis-backed integration tests separate to verify distributed storage and concurrency.
- What are alternatives to symfony/rate-limiter for Laravel applications?
- Laravel's built-in RateLimiter and throttle middleware are the default alternatives for simple per-route or per-user limits. You might choose symfony/rate-limiter when you need explicit token bucket reserve/consume semantics, compound limits, or Symfony-compatible storage abstractions. Compare policy needs, storage backend, and operational overhead before adding another dependency.
- Is symfony/rate-limiter actively maintained and safe for production?
- It is maintained as part of Symfony, and the evaluation references v8.1.6 with a burst-size bug fix. Production safety still depends on using Redis or database storage for distributed limits and testing your configuration. Run PHPStan in CI and monitor rate-limiting behavior before rolling out to critical endpoints.
Weaver
How can I help you explore Laravel packages today?