Secure Laravel with Rate Limiting, Throttling, and CSRF

Summary: Protect your application from common web threats.

Web applications face constant threats, from brute-force login attempts to automated abuse of endpoints and sneaky cross-site request forgery (CSRF) attacks. As a developer, safeguarding your Laravel application is not just wise—it's essential. This article explores how to protect your app using rate limiting, throttling, and CSRF protection, all using Laravel’s mature security features.

Why Secure Your Laravel Application?

Modern web applications are a prime target for attackers seeking vulnerabilities. Common threats include:

  • Flood attacks: Sending so many requests that your application slows down or crashes.
  • Brute force attacks: Guessing login credentials or sensitive data with repeated attempts.
  • CSRF: Unauthorized commands sent from trusted users' browsers.

Let's look at how Laravel helps you mitigate these threats.

1. Implementing Rate Limiting in Laravel

What Is Rate Limiting?

Rate limiting restricts the number of times a user or client can hit a particular endpoint within a specified timeframe. This is crucial in protecting APIs, authentication endpoints, or any route susceptible to abuse.

Laravel’s Built-in Rate Limiting

Laravel uses the ThrottleRequests middleware for rate limiting. Laravel 8+ introduced a more robust rate limiter powered by the RateLimiter facade.

Example: Limiting Login Attempts

Edit your routes/web.php or routes/api.php file:

use Illuminate\Support\Facades\Route;

Route::middleware(['throttle:5,1'])->post('/login', 'Auth\LoginController@login');

This throttles the /login route to 5 requests per minute per IP.

You can also create custom rate limiters in the boot method of your RouteServiceProvider.

use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Support\Facades\RateLimiter;
use Illuminate\Http\Request;

public function boot()
{
    RateLimiter::for('login', function (Request $request) {
        return Limit::perMinute(5)->by($request->ip());
    });
    
    // In your routes file:
    Route::middleware(['throttle:login'])->post('/login', 'Auth\LoginController@login');
}

Customize Response on Limit Reached

To customize the message or action when a user exceeds their limit, override the throttle middleware in app/Exceptions/Handler.php.

2. Throttling: Going Beyond Rate Limiting

While rate limiting generally focuses on the number of requests, throttling adds even more flexibility—allowing you to:

  • Throttle by user or API key: Not just IP address, but authenticated user or other identifiers.
  • Throttle specific actions: e.g., password reset or resource creation endpoints.

Use Laravel’s RateLimiter to define fine-grained throttling:

RateLimiter::for('api', function (Request $request) {
    return $request->user()
        ? Limit::perMinute(60)->by($request->user()->id)
        : Limit::perMinute(10)->by($request->ip());
});

In the above, authenticated users get more generous limits; guests get stricter ones.

3. CSRF Protection in Laravel

What is CSRF?

Cross-Site Request Forgery (CSRF) tricks authenticated users into submitting unwanted requests to your app. This might allow malicious changes or reveal sensitive information.

Laravel’s CSRF Middleware

By default, all web routes are protected using the VerifyCsrfToken middleware. When you create forms using Laravel’s Blade templates, always include the CSRF @csrf directive:

<form method="POST" action="/update-profile">
    @csrf
    <!-- form fields -->
    <button type="submit">Update</button>
</form>

This generates a hidden input field containing a secure token. The middleware validates this token on every POST, PUT, PATCH, or DELETE request.

AJAX and CSRF

For AJAX requests, add the CSRF token to your request headers:

$.ajaxSetup({
    headers: {
        'X-CSRF-TOKEN': $('meta[name="csrf-token"]').attr('content')
    }
});

Or, in Vue.js / Axios:

axios.defaults.headers.common['X-CSRF-TOKEN'] = document.querySelector('meta[name="csrf-token"]').getAttribute('content');

Make sure the token is present in your HTML’s <head>:

<meta name="csrf-token" content="{{ csrf_token() }}">

Excluding Routes

Occasionally, you may need to exclude certain URLs from CSRF protection, such as webhook endpoints. Edit app/Http/Middleware/VerifyCsrfToken.php:

protected $except = [
    'webhook/*',
];

Note: Exclude endpoints ONLY when necessary, and ensure those endpoints are otherwise secured.

Summary Table

Feature Laravel Implementation Default Status
Rate Limiting ThrottleRequests middleware, RateLimiter Built-in, opt-in
Throttling Custom rate limiters Available
CSRF Protection VerifyCsrfToken middleware, @csrf Blade Built-in, ON

Best Practices

  • Regularly audit your rate/throttle limits to balance user experience and security.
  • Always use CSRF tokens for forms and AJAX.
  • Log throttling events to spot suspicious activity.
  • For APIs, consider OAuth or API keys for added security.

Conclusion

Laravel provides robust tools to guard your application against abuse and web attacks. By properly implementing rate limiting, throttling, and CSRF protection, you drastically reduce your attack surface and improve your app’s resilience.

Secure coding is not a one-time task, but an ongoing practice. Stay vigilant. Ship safe applications.

Further Reading:

Back to All Articles