Weave Code
Rate Limiter Laravel Package
symfony/rate-limiter
Symfony Rate Limiter provides token bucket rate limiting for your app. Create limiters with RateLimiterFactory and a storage backend (e.g., in-memory), then reserve tokens with blocking waits or consume instantly to allow/skip work based on availability.
Provides a Token Bucket implementation to rate limit input and output in your application
Frequently asked questions about Rate Limiter
- How do I integrate Symfony Rate Limiter into Laravel middleware for API rate limiting?
- Replace Laravel’s throttle middleware by injecting `RateLimiterFactory` into a custom middleware. Use `consume(1)` to check token availability and return a 429 response with `Retry-After` header if exceeded. Example: `if (!$limiter->consume(1)->isAccepted()) { return response()->json(['error' => 'Too Many Requests'], 429)->header('Retry-After', $limiter->getRetryAfter()->format('U')); }`
- Which storage backend should I use for distributed Laravel applications?
- For distributed environments, use `RedisStorage` or `DoctrineStorage` instead of in-memory storage. Configure via `RateLimiterFactory` with Redis connection details or Doctrine entity manager. Example: `new RedisStorage(app('redis')->connection('cache'))`.
- Can I apply rate limiting to Laravel queue jobs (e.g., payment processing)?
- Yes. Wrap job execution logic with `consume(1)` or `reserve(1)->wait()` in the job’s `handle()` method. Example: `if ($limiter->consume(1)->isAccepted()) { Payment::process(); }`. Use Redis storage for distributed queues to avoid race conditions.
- What’s the difference between `reserve()` and `consume()` in Symfony Rate Limiter?
- `reserve()` blocks execution until a token is available (useful for CLI or long-running tasks), while `consume()` checks for tokens instantly and returns a boolean. Use `reserve()` for synchronous blocking (e.g., CLI imports) and `consume()` for HTTP requests where you want to fail fast.
- Does Symfony Rate Limiter support Laravel’s caching backends (Redis, database) out of the box?
- Yes. Use `RedisStorage` for Redis and `DoctrineStorage` for database-backed rate limiting. Configure storage via `RateLimiterFactory` with Laravel’s Redis or database connections. Example: `new RedisStorage(app('redis')->connection('cache'))` or `new DoctrineStorage($entityManager)`.
- How do I implement multi-dimensional rate limiting (e.g., per-IP and per-user) in Laravel?
- Use `CompoundRateLimiterFactory` (Symfony 7.3+) to combine multiple limiters. Example: `factory->createCompound(['ip_limiter', 'user_limiter'])` where each limiter targets a specific dimension (e.g., IP via `Request::ip()`, user via `auth()->id()`).
- What Laravel versions and PHP versions does Symfony Rate Limiter support?
- Symfony Rate Limiter requires PHP 8.1+ (v8.1+) or PHP 8.0+ (v8.0) for full features. For PHP 7.4+, pin to `symfony/rate-limiter:^7.4`. Works with Laravel 9+ (PHP 8.0+) or Laravel 8+ (PHP 7.4+) with compatibility adjustments.
- How can I log rate-limiting events for auditing or SOC 2 compliance?
- Emit custom Laravel events when rate limits are exceeded (e.g., `RateLimitExceeded`). Log these events via Monolog or Laravel’s logging channels. Example: `event(new RateLimitExceeded($limiter->getId(), $request->ip()))`.
- What are the performance implications of using Redis for high-throughput APIs (10K+ RPS)?
- Redis adds minimal latency (~1–5ms) for token operations. For high-throughput APIs, ensure Redis is clustered or sharded. Test under load with tools like `k6` or `artillery` to validate `reserve()`/`consume()` response times meet SLA requirements.
- What fallback strategy should I use if Redis fails during rate limiting?
- Implement a circuit breaker pattern (e.g., using `spatie/flysystem-circuit-breaker`) to fall back to in-memory storage or allow requests during outages. Log failures and alert monitoring (e.g., Laravel Horizon) to trigger Redis recovery procedures.
Weaver
How can I help you explore Laravel packages today?