Let's learn how to make use of login throttling in Laravel 5.1. So I have a fresh install of the framework, literally all that I've done is set the environment file, I've set my database, that's it, okay? So let's go ahead and migrate our database, and that'll give us the two tables that come with Laravel out of the box. And then next, if I switch over to my routes.php file, we want to register all of the routes for logging in, registering, etc. Now the controller functionality for doing authentication is included out of the box, but the views or the routes are not. So if you just visit the documentation and scroll down a ways, here you go, you can copy

but the views or the routes are not. So if you just visit the documentation and scroll down a ways, here you go, you can copy and paste that. All right, so I will add that here, and we're not going to worry about registration, so I can remove that. Now remember, the Auth\AuthController is included out of the box, like I just said. So controllers, Auth, Auth\AuthController. Now if you take a look at this, in Laravel 5.1, you'll see that it pulls in, by default, a trait called ThrottlesLogins. Okay, so what does login throttling even mean?

a trait called ThrottlesLogins. Okay, so what does login throttling even mean? Well think about it. You have a website, somebody visits it, and they try to log in. Now let's imagine they're malicious, okay? So they type in your email address, but just some random password. It fails, right? So they try another password, it fails. So they try another one. Now imagine that you can automate this process, and then consider the possibility that the

So why don't we do this? Let's see this in action, and then we'll take a moment to look into the source code and figure out how exactly does this work. Okay. So if we take a look at the AuthenticatesUsers trait that the AuthController references, the login page will attempt to load an auth/login view. Let's create that. resources/views/auth/login.blade.php. And I also probably need a master page. So resources/views/layout.blade.php.

And I also probably need a master page. So resources/views/layout.blade.php. Paste this in. I'll pull in Bootstrap to make the form look good. And then within a container, I will yield the content. All right. Now back in our login view, I will extend our layout. And for our main content section, we need a login area, right? Login. And then I think I have a login form snippet here.

Login. And then I think I have a login form snippet here. I do. Pretty basic. We've created these millions of times, right? We have a form that posts to /auth/login. Don't forget, that corresponds to the routes that we set up right here. Okay. Next we have a CSRF field to protect ourselves against cross-site request forgery. And then a section for the email, the password, and then a checkbox if they want to be remembered.

Next we have a CSRF field to protect ourselves against cross-site request forgery. And then a section for the email, the password, and then a checkbox if they want to be remembered. Finally, a login button. So why don't we view this in the browser? All right. Sure enough, here's our form. Now if we try to submit it, notice it redirects back, but we don't see anything here. Of course we don't. We need the errors. So right down here at the bottom, once again, I recommend creating snippets for things like

Now, how many times can we do this before we get locked out? Let's see what they've set up here. I will go to throttles, logins, and let's see, getLoginAttempts. And then we see if attempts is greater than 5. So 5 is the total number of attempts you can try before we temporarily lock your access. Okay. Let's try it. I'll do jeffrey@laracasts.com and gibberish, gibberish, 3, 4, 5. And if I do it one more time, you'll see this message change. And it does.

So now that you understand how to use this, let's figure out what exactly happens. All right. Well, if we go back to the AuthController, you'll see that it pulls in a AuthenticatesUsers and RegistersUsers traits, and then also throttles logins. So let's go first and take a look at the getLogin method. All right. We load the login view that contains the form, right? You submit the form and we hit the postLogin method. And this is where, well, we first validate the request. So we will do that no matter what.

And this is where, well, we first validate the request. So we will do that no matter what. We'll make sure you did give us a name and password. But then notice right here, is using ThrottlesLogins trait. What this is doing is it checks to see, did you import this trait? So for example, if you don't want login throttling, all you have to do is remove this. It checks for that behind the scenes. Okay. So if you imported that trait and we have too many login attempts, let's see what happens there.

So if you imported that trait and we have too many login attempts, let's see what happens there. To determine if the User has tried too many times, we fetch the number of attempts. So you'll see right here, all that does is fetch something from the cache. So we have this key here, getLoginAttemptsKey. Well, remember if we're storing something in the cache, but it would be user specific, well, we would need to reference, for example, the username they gave us. And then in this case, it also concatenates the IP address to it. And then we wrap that in md5 and return a string. So that is your cache key.

And then we wrap that in MD5 and return a string. So that is your cache key. Now if we scroll back, hasTooManyLoginAttempts, and we switch here, we fetch that value. So the first time that would be zero, and then one, then two, and then three. Okay. Next we say, we can skip this for the time being. If the number of attempts is greater than 5, then we're going to temporarily lock you. So we say cache()->put(), once again, we generate another user specific cache key.

you. So we say cache put, once again, we generate another User specific cache key. We set that value equal to the current time plus 60 seconds. So basically the value is the time for one minute from now. And we say the cache can expire in one minute. Finally, we return true because we've decided they have tried to log in too many times. Now, before we return, we can go back here. Because this method will be hit every single time, well, we don't have to keep pushing or putting to the cache. We can say if the attempts is greater than five, or we've already gone through this cycle.

or putting to the cache. We can say if the $attempts is greater than five, or we've already gone through this cycle and locked the $user out, then return true ultimately. Okay, let's see what else. We've decided the $user has tried too many logins. So at this point, we halt all progress. So this is what I meant when I said we don't even get to the auth attempt section if we've implemented login throttling. Before we even get there, we send a lockout response. And if you take a look at that, we determine how many more seconds until the cache will

Before we even get there, we send a lockout response. And if you take a look at that, we determine how many more seconds until the cache will expire. We set up a message that says, please try again in 50 seconds or 45 seconds. And then we redirect back to the login page. And we also add some errors here. And we do that right here, specifically because, well, we want to display it within our errors list. Okay, now let's go back and take another run through it. So let's imagine that this fails. Your login attempt failed, but it hasn't been too many times.

So let's imagine that this fails. Your login attempt failed, but it hasn't been too many times. Okay, in that case, we try to log you in. And if all turns out well, we'll clear the cache and log the User in. Otherwise, if we get to that point, if we are importing that ThrottlesLogins trait, then we increment the logins count. This is how we increment that each time. And then the next time we make a request, we do that check. But this time, the loginAttempts is one greater than it was before. So really, it's very, very simple stuff.

We can forget them entirely, and that's specifically what we do. So there you have it, folks. Login throttling in Laravel 5.1.