Next up is rate limiting. So let's begin by going into a Laravel 7 project, into app, Http, Kernel.php. And yeah, right here, if we scroll down to our middleware groups, have a look at this one here. So this is the Laravel 7 and below way for defining API rate limiting. So effectively, what this means is for the API middleware group, for any endpoint, you can ping it a maximum of 60 times per minute. Now, if I were to change this to how about three, we could then go into routes, api.php. Let's just set up one here really quick, Route::get('foo', function () { return 'string'; }); Now, if I run this in the browser, here's that endpoint /api/foo. Let's give it a couple of runs. Two, three, four. There we go. 429. Too many requests. So that's a very quick example of rate limiting in Laravel 7. However, if we now switch over to Laravel 8, it's slightly different. So to begin, if we open up our Http\Kernel.php, you'll no longer see us passing through

example of rate limiting in Laravel 7. However, if we now switch over to Laravel 8, it's slightly different. So to begin, if we open up our HTTP Kernel, you'll no longer see us passing through the limit as part of the string here, even though that would still work. Instead, that is defined in your RouteServiceProvider. So right here, scroll on down. This file is a little bit different from version 7. But here you can see configureRateLimiting. So when this middleware is booted, we immediately configure it using this new syntax. So you have a RateLimiter class and a companion Limit class. So API is just the name of a string. You can call it anything you want. Our rate limiter for API requests will return a limit of 60 requests per minute. Now, once again, let's bring this down just so we can toy around with it. If I now go to routes/api and once again create a dummy little route here, fooBar, I'll now switch over to a Laravel 8 project.

let's bring this down just so we can toy around with it. If I now go to routes/api and once again create a dummy little route here, fooBar, I'll now switch over to a Laravel 8 project and a new tab. So laravel8.test 1, 2, 3, 4, and we get the exact same thing. Now, again, it might be a little blurry how things are wired up because we have a lot of references to API, API, API, and they're not all the same thing. The thing to pay attention to is right here. We're defining a rate limiter with a key of API, and that logic is three requests per minute. Now, in your kernel, we are applying this to any middleware that just so happens to have the name API, but it doesn't have to be the same, as I'll show you in just a minute. But for this middleware group, we will apply a rate limit throttle with the name of API. So, for example, if I were to set this to fooBar, okay, let's just make sure it lines up here and we'll get the exact same thing,

group, we will apply a rate limit throttle with the name of API. So, for example, if I were to set this to foobar, okay, let's just make sure it lines up here and we'll get the exact same thing, 2, 3, 4, and it works. Okay. So now, yeah, if you wanted to, first, let's bring it back to what I had earlier. Yeah. Why don't we define a new one? I'll show you some options here. I could make a rate limiter for anything you want. Usually, it will be something like pinging an API. So maybe based on your access level or your permissions, you can hit this API a maximum of a hundred times a minute. But maybe if you pay extra or you're a second party retailer or something like that, you have unlimited requests, you know, things like that. Maybe we'll do one called downloads. So this will accept the request. And yet again, I could say return limit per minute of how about two this time? Okay. So now you've defined a rate limiter, but it hasn't yet been

called downloads. So this will accept the request. And yet again, I could say return limit per minute of how about two this time? Okay. So now you've defined a rate limiter, but it hasn't yet been applied. Now, in the previous example up here, it was done automatically for you by Laravel, but otherwise, just do it manually like this. How about we'll define a new one here to represent some kind of downloads endpoint. You get the idea. However, now I'm going to apply rate limit throttling. Throttle in what was the name? Downloads. And then we'll just update this to some file download call. All right, let's give it a shot. We will visit downloads one, two, three, and the rate limiting is now in effect. And if I were to wait 60 seconds, I would get another three requests. So last little thing, of course, if I were to switch back here, this is going to be based per user, right? So what you could do is, for example, in the case of Laracast, maybe I

three requests. So last little thing, of course, if I were to switch back here, this is going to be based per User, right? So what you could do is, for example, in the case of Laracast, maybe I wanted to say if the user is a forever user, so they've purchased a forever or lifetime account. In that case, maybe I allow them unlimited requests. In that case, I can say there's no limit represented by limit none. And you'll see that just returns an unlimited rate limit. But yeah, otherwise, if you're not a lifetime member, maybe I will set a limit like, I don't know, 30 requests per minute. Anything you want that would make sense for your application. So this would be a way to configure your rate limiter on a per User basis. All right, and that's all there is to it.