Download the PHP package aporat/laravel-rate-limiter without Composer

Laravel Rate Limiter

A flexible rate limiting middleware for Laravel applications, designed to throttle requests and actions using Redis.

Features

• Configurable rate limits per hour, minute, and second.
• Flexible limiting by IP, user ID, request method, and custom tags.
• IP blocking for abuse prevention.
• Optional rate limit headers in responses.
• Redis-backed storage for scalability.

Requirements

• PHP: 8.4 or higher
• Laravel: 12.x or 13.x
• Redis: Required for storage (ext-redis extension)
• Composer: Required for installation

Installation

Install the package via Composer:

RateLimiterServiceProvider is registered automatically via Laravel's package discovery. If auto-discovery is disabled, add it to bootstrap/providers.php:

The package deliberately does not register a RateLimiter class alias, because that name is taken by Laravel's own Illuminate\Support\Facades\RateLimiter. Import this package's facade by its full name instead:

Publish the configuration file:

Configuration

Edit config/rate-limiter.php:

Anything set explicitly under redis overrides the named connection it inherits from. prefix is applied by the package rather than through Redis::OPT_PREFIX, so the keys the package scans and deletes are the same names it writes.

Config is read live from the container on each call, so a runtime Config::set() is picked up by the long-lived singleton.

Usage

Middleware

The provider registers the rate.limiter alias. Apply it to a route group:

Or register it globally in bootstrap/app.php:

Each configured window (hourly, minute, second) gets its own counter keyed on the client IP; a window set to 0 is skipped. Addresses matching whitelisted_ips bypass the middleware entirely.

Put the middleware after your trusted-proxy middleware, so getClientIp() returns the real client rather than the load balancer.

Manual Rate Limiting

create() resets the tag, window and attached response, so the singleton is safe to reuse. limit() throws RateLimitException once the count passes the limit; record() increments and returns the count without throwing, which is what you want for duplicate-request detection:

The increment and its expiry are applied in a single Lua script, so a counter can never be left without a window if the process dies mid-call, and a key that has somehow lost its TTL gets one back on the next write.

IP Blocking

IPv6 addresses are grouped by their /64 prefix for both counting and blocking, so a single client cannot rotate through a subnet it already controls.

Rate Limit Headers

Exception handling

RateLimitException implements HttpExceptionInterface, so Laravel renders it as a 429 with a Retry-After header out of the box. Two deliberate omissions:

• It does not extend Symfony's HttpException, because that class is on the framework's internal "don't report" list, which would silence your own reporters.
• It does not define render(), because an exception's own render() takes precedence over $exceptions->render() callbacks — the rendering decision stays with your application.

With log_errors set to false, report() returns false so Laravel continues on to your registered report callbacks:

Request bodies and headers written to the log are redacted for the usual credential keys (authorization, cookie, password, x-auth-signature, ...).

Testing

The suite talks to a real Redis on 127.0.0.1:6379 (database 15), overridable with REDIS_HOST and REDIS_PORT:

Static analysis and code style:

Contributing

Contributions are welcome! Please:

1. Fork the repository.
2. Create a feature branch (git checkout -b feature/new-feature).
3. Commit your changes (git commit -m "Add new feature").
4. Push to the branch (git push origin feature/new-feature).
5. Open a pull request.

Report issues at GitHub Issues.

License

This package is licensed under the License File for details.

Support

• Issues: GitHub Issues
• Source: GitHub Repository