Per-Second Rate Limiting in Laravel 11

Per-Second Rate Limiting is a new feature in Laravel 11, providing more control over the rate limiting of your application's routes.For instance, you might want to ensure that a user can't make more than one request per second to avoid overloading your server.

Setting Up Per-Second Rate Limiting

You can define rate limits for your routes on a per-second basis, in addition to the traditional per-minute rate limits. This feature is beneficial for APIs that require stricter rate limits to prevent misuse.By setting limits on a per-second basis, you can protect your server from rapid bursts of traffic that might not breach per-minute limits but can still cause significant load and potential downtime.

Define Rate Limits in RouteServiceProvider

To set up per-second rate limiting, you need to define custom rate limits in the RouteServiceProvider. This is done in the boot method of your RouteServiceProvider.

namespace App\Providers; use Illuminate\Cache\RateLimiting\Limit; use Illuminate\Http\Request; use Illuminate\Support\Facades\RateLimiter; use Illuminate\Support\Facades\Route; use Illuminate\Foundation\Support\Providers\RouteServiceProvider as ServiceProvider; class AppServiceProvider extends ServiceProvider { /** * Bootstrap any application services. */ public function boot() { $this->configureRateLimiting(); $this->routes(function () { Route::middleware('api') ->prefix('api') ->group(base_path('routes/api.php')); // Make sure the file routes/api.php exists }); } /** * Configure the rate limiters for the application. */ protected function configureRateLimiting() { // Default rate limiter for the 'api' routes, allowing 60 requests per minute. RateLimiter::for('api', function (Request $request) { return Limit::perMinute(60)->by(optional($request->user())->id ?: $request->ip()); }); // Custom rate limiter for 'test' route, with different limits per second and per minute. RateLimiter::for('test', function (Request $request) { return [ Limit::perSecond(1)->by($request->ip()), // Limit to 1 request per second by IP address. Limit::perMinute(10)->by($request->ip()), // Limit to 10 requests per minute by IP address. ]; }); } }

Apply Rate Limits to Routes

After defining the rate limits, you can apply them to specific routes using middleware. In your 'routes/api.php', define a route that uses the rate limiting middleware:

Route::middleware(['api', 'throttle:test'])->get('/test', function () { return response()->json(['message' => 'API route is working']); });

In this example, the /test route is limited to 1 request per second and 10 requests per minute.