I'm working with Laravel 5.8 and I wanted to set up a Rate Limiter that limits accessing to route by per minute and also IP address.
So I added this to RouteServiceProvider.php:
protected function configureRateLimiting()
{
RateLimiter::for('limited', function (Request $request) {
return [
Limit::perMinute(500),
Limit::perMinute(20)->by($request->ip()),
];
});
}
And then applied it to Route:
Route::get("/", "StaticPages\HomeController@show")->middleware('throttle:limited')->name('home');
So it should be limiting access after 500 attempts or 20 attempts from the same IP address.
But now the problem is it shows 429 Too Many Requests after only ONE attempt!
I don't know why it limits the access after only one attempt.
So what's going wrong here?
How can I properly set the limitation based on IP address to 20 and 500 requests per minute?
I think you have read the wrong documentation in your attempt to implement a request rate limiter in Laravel. The "named throttle" is only introduced as of version 8. It is not available in version 5.8, see the laravel documentation for that particular version.
If you declared the throttle as follows:
Route::get("/", "StaticPages\HomeController@show")->middleware('throttle:20,1')->name('home'); You can see in the HTTP header it returns that it says x-ratelimit-remaining 19 after the first request. So speed limiting works as it is supposed to. However, if you put throttle:limited , it would not understand what it means and return -1 for x-ratelimit-remaining , which is why it may open the page once and return HTTP 429 error for subsequent requests.
If you still have doubts about my explanation, put a die() at the beginning of configureRateLimiting like so:
protected function configureRateLimiting() { die(); RateLimiter::for('limited', function (Request $request) { return [ Limit::perMinute(500), Limit::perMinute(20)->by($request->ip()), ]; }); }If Laravel actually executes that particular function, your app should stop working before it can respond to any requests. If not, it will just work fine.
At this point, you only have 2 options to implement your rate limiter policy: 1) implement your own rate limiter middleware; 2) update your Laravel to at least version 8
FYI, in the top right corner of the Laravel documentation page, you can set which version of the documentation you want to read.
I think you need to write code [return response('Custom response...', 429); ] in functions.
RateLimiter::for('limited', function (Request $request) { return Limit::perMinute(1000)->response(function () { return response('Custom response...', 429); });For more information on rate limiting:
I agree with @Bagus Tesa. Laravel 5.8 throttle middleware don't accept parameters except max_rate and per_minutes. Named rate limiting was introduced in Laravel 8 and only available in >= Laravel 8 versions. Either you can implement your own rate limiting middleware or upgrade to Laravel 8 to achieve expected functionality.