Weave Code
Rate Limiter Laravel Package
symfony/rate-limiter
Symfony Rate Limiter provides token bucket rate limiting for your app. Create limiters with RateLimiterFactory and a storage backend (e.g., in-memory), then reserve tokens with blocking waits or consume instantly to allow/skip work based on availability.
Provides a Token Bucket implementation to rate limit input and output in your application
Frequently asked questions about Rate Limiter
- How do I integrate Symfony Rate Limiter with Laravel’s throttle middleware?
- Replace Laravel’s built-in throttle middleware with a custom middleware using `RateLimiterFactory`. Inject the limiter into your middleware and call `$limiter->reserve()->wait()` before processing requests. This ensures consistent token bucket behavior across all endpoints, including those protected by `throttle`.
- Can I use Redis for distributed rate limiting in a Laravel Kubernetes cluster?
- Yes, configure `RateLimiterFactory` with a Redis-backed storage (e.g., `RedisStorage`) to share rate limits across all instances. This avoids contention and ensures consistent limits even with horizontal scaling. Redis adds ~5ms latency but is essential for distributed setups.
- What’s the difference between `reserve()->wait()` and `consume()` in Symfony Rate Limiter?
- `reserve()->wait()` blocks execution until tokens are available, ideal for critical operations like logins or payments. `consume()` checks immediately and returns a boolean, letting you skip work if limits are exceeded—useful for non-blocking scenarios like background jobs or optional features.
- How do I set up compound rate limits (e.g., per-IP *and* per-user) in Laravel?
- Use `CompoundRateLimiterFactory` to combine multiple limiters (e.g., one for IP, one for user ID). Configure each with its own policy (e.g., `token_bucket`) and storage. This is perfect for SaaS apps where you need multi-dimensional protection without overcomplicating logic.
- Will Symfony Rate Limiter work with Laravel Queues (e.g., Job::handle())?
- Absolutely. Inject the limiter into your job’s `handle()` method and call `$limiter->consume(1)->isAccepted()` before processing. This prevents queue workers from overwhelming resources during traffic spikes, similar to how you’d protect API endpoints.
- What’s the best storage backend for production Laravel apps with high traffic?
- For production, use Redis or Memcached for distributed storage to avoid single-instance bottlenecks. In-memory storage is fine for single-server setups but won’t scale. Always configure a fallback (e.g., database or deny-all) if Redis fails to prevent service degradation.
- How do I dynamically adjust rate limits (e.g., via config or API) in Laravel?
- Rebuild the `RateLimiterFactory` with new limits when config changes (e.g., via `config('rate_limits.login')`). Cache the factory as a singleton in Laravel’s service container to avoid recreating it on every request. For real-time adjustments, use a cache driver like Redis to store limits.
- Does Symfony Rate Limiter support Retry-After headers for HTTP APIs?
- Yes, the component automatically calculates `Retry-After` headers (RFC 6585) when using `reserve()->wait()`. This improves API client UX by telling them exactly when to retry, reducing support tickets and failed requests.
- How can I test rate limiting in Laravel with load testing tools like k6?
- Mock the storage layer in unit tests (e.g., `InMemoryStorage`) to simulate token acquisition. For load testing, use k6 to send rapid requests and verify `Retry-After` headers or HTTP 429 responses. Compare results against your expected token bucket behavior.
- What are the alternatives to Symfony Rate Limiter for Laravel, and when should I choose them?
- Laravel’s built-in `throttle` middleware is simpler but uses fixed windows, not token buckets. For advanced use cases (e.g., compound limits, serverless), Symfony’s component is superior. If you need Redis-based rate limiting with minimal setup, consider `spatie/laravel-rate-limiting`. Choose Symfony for flexibility and HTTP compliance.
Weaver
How can I help you explore Laravel packages today?