What does Laravel middleware `throttle:api` mean?

Detailed explanation of the speed limit function of laravel middleware

In the laravel framework, middleware plays an important role. They can intercept and process requests, implement functions such as permission verification, logging, and speed limit. This article will explore the use of throttle middleware in laravel in depth, especially the usage of 'throttle:api'.

The problem stems from a laravel routing middleware configuration code:

 'api' => [
    // \laravel\sanctum\http\middleware\ensurefrontendrequestsarestateful::class,
    'throttle:api',
    \illuminate\routing\middleware\substitutebindings::class,
],

Among them, 'throttle:api' aroused the question from the questioner. Everyone knows that this is a speed limit middleware, but the meaning of the API parameters is not clear. The common speed limit middleware configuration is often throttle:60,1, which means that 60 requests are allowed per minute. So what exactly does 'throttle:api' mean?

The answer lies in the parameter passing method of the throttle middleware. Laravel's middleware supports parameter passing, parameters start with colon: and multiple parameters are separated by commas. As a weak-type language, the flexible use of parameter types and number of parameters makes the configuration methods more diverse.

throttle:api means using a ratelimiter called api. This means that the system controls the request frequency according to a rate limiter rule called API. The rate limiter needs to be predefined in the laravel configuration, which determines the number of requests allowed and the time window.

throttle:60,1 means directly specifying the speed limit rule: 60 requests per minute (1 minute, $decayminutes = 1) are allowed ($maxattempts = 60).

The source code fragment of the throttle middleware is as follows:

 /**
     * /Illuminate/Routing/Middleware/ThrottleRequests.php
     * Handle an incoming request.
     *
     * @param \Illuminate\Http\Request $request
     * @param \Closure $next
     * @param int|string $maxAttempts
     * @param float|int $decayMinutes
     * @param string $prefix
     * @return \Symfony\Component\HttpFoundation\Response
     * 
     * @throws \Illuminate\Http\Exceptions\ThrottleRequestsException
     * 
     */
    public function handle($request, Closure $next, $maxAttempts = 60, $decayMinutes = 1, $prefix = '')
    {
        if (is_string($maxAttempts)
            && func_num_args() === 3
            && ! is_null($limiter = $this->limiter->limiter($maxAttempts))) {
            return $this->handleRequestUsingNamedLimiter($request, $next, $maxAttempts, $limiter);
        }
        
        // ....
     }

This code shows how the middleware handles different parameter forms. When $maxattempts is a string and the number of parameters is 3 (that is, only the name is passed), the middleware will try to use a ratelimiter named $maxattempts.

Through analysis of source code and parameter delivery methods, we can clearly understand the meaning of 'throttle:api': it does not directly specify the speed limit rules, but refers to a predefined rate limiter called api. This allows developers to more flexibly manage speed limiting strategies for different API interfaces.

The above is the detailed content of What does Laravel middleware `throttle:api` mean?. For more information, please follow other related articles on the PHP Chinese website!