Using Rate Limiting for Brute Force Protection

Brute-force attacks work by repeatedly guessing passwords or codes until one succeeds. Laravel's rate limiting can slow these attempts to a crawl, making them impractical.

Throttling the Login Route

Route::post('/login', [LoginController::class, 'login'])
    ->middleware('throttle:5,1');

This limits login attempts to 5 per minute per client, after which further attempts return a 429 Too Many Requests response.

Laravel's Built-in Login Throttling

Laravel's authentication scaffolding already includes a more advanced form of this behaviour, using the ThrottlesLogins trait, which locks out an account after repeated failed attempts and tracks lockouts per username-and-IP combination.

use Illuminate\Foundation\Auth\ThrottlesLogins;

Tuning the Lockout

With authentication, input handling, and abuse protection covered, the course now moves into a different area entirely: making an application usable in more than one language.