Livewire Rate Limiting

Livewire Rate Limiting is a small Laravel package that lets any Livewire component throttle its own actions using Laravel’s built-in rate limiter infrastructure. Adding the WithRateLimiting trait to a component gives it rateLimit(), hitRateLimiter(), and clearRateLimiter() methods, so a single line inside an action method — such as a login submit() handler — enforces a max-attempts-per-decay-period policy without any manual cache key management.

When a limit is exceeded, the package throws a TooManyRequestsException carrying the offending component class, requester IP, method name, and both minutes/seconds remaining until the limit resets, so the calling code can surface a precise, user-facing message (typically via Laravel’s ValidationException) rather than a generic error.

What You Get

• A WithRateLimiting trait adding rateLimit($maxAttempts, $decaySeconds, $method), hitRateLimiter(), and clearRateLimiter() to any Livewire component
• A TooManyRequestsException carrying the component class, requester IP, method name, and both minutesUntilAvailable/secondsUntilAvailable for building precise user-facing messages
• Automatic per-method, per-request-context rate limit keys, so $this->rateLimit(10) inside a submit() method is scoped without manual cache-key construction
• Compatibility across Laravel v9.x through v13.x and PHP 8.0+, tested against both file and redis cache drivers

Common Use Cases

• Throttling login-form submit actions in a Livewire component to slow down brute-force credential-stuffing attempts
• Rate-limiting comment, contact-form, or newsletter-signup submissions built as Livewire components to reduce spam
• Protecting expensive or side-effecting Livewire actions (password resets, OTP requests, search-triggering API calls) from being spammed by a single user
• Adding throttling to any Livewire Volt component action with the same trait-based API

Under The Hood

Architecture — The package is intentionally minimal: src/WithRateLimiting.php is the sole trait providing rateLimit(), hitRateLimiter(), and clearRateLimiter(), and src/Exceptions/TooManyRequestsException.php defines the single exception type thrown on limit breach. Internally it delegates to Laravel’s own Illuminate\Support\Facades\RateLimiter (the same rate limiter used by Laravel’s HTTP throttle middleware), so it doesn’t reimplement limiting logic — it adapts Laravel’s existing primitive to Livewire’s component-action model, deriving a rate-limit key from the component instance and calling method by default.

Tech Stack — Pure PHP, depending only on illuminate/support (^9.0 through ^13.0) for the underlying rate limiter, with livewire/livewire, livewire/volt, and orchestra/testbench as dev dependencies for testing against real Livewire components. No JavaScript or frontend assets are involved — the throttling logic runs entirely server-side.

Code Quality — The package ships a tests/ directory exercised via PHPUnit and Orchestra Testbench (Laravel’s standard package-testing harness), and the README explicitly documents that the package is tested against the file and redis cache drivers but not array — a specific, useful caveat since Laravel’s array cache driver doesn’t persist across requests and would silently defeat rate limiting in production-like tests. A SECURITY.md and CODE_OF_CONDUCT.md indicate maintained community-facing process for a security-adjacent package.

API Design — The trait-based API requires a single use WithRateLimiting; plus one $this->rateLimit($maxAttempts) call inside the action to protect, with the rate-limited method name auto-detected from the call site by default (overridable via the third argument). Catching TooManyRequestsException and reading its secondsUntilAvailable/minutesUntilAvailable properties directly gives a ready-to-display countdown message, minimizing boilerplate for the most common use case (surfacing a ValidationException with a wait-time message).