People searching “Laravel login rate limit” raise the limit until the lockout “goes away”. The lockout is the feature. The Vue starter kit registers a limiter named login in App\Providers\FortifyServiceProvider. The Fortify guide is the form that trips it.
TL;DR
- Fortify’s login limiter is five attempts a minute.
- The Vue page shows the message on the username field.
- Do not clear cookies to bypass it.
- Do not key the limiter on the IP alone if you expect an office to share one address, and do not key it on the email alone if one password can be tried from anywhere.
The fix#
use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Support\Facades\RateLimiter;
use Illuminate\Support\Str;
use Laravel\Fortify\Fortify;
RateLimiter::for('login', function (Request $request) {
$key = Str::transliterate(Str::lower($request->input(Fortify::username())).'|'.$request->ip());
return Limit::perMinute(5)->by($key);
});Five failures for that email and IP return a validation error. Show it the same way as a wrong password:
<p v-if="form.errors.email">{{ form.errors.email }}</p>What to avoid#
Gotcha
Do not clear cookies to bypass it. Do not key the limiter on the IP alone if you expect an office to share one address, and do not key it on the email alone if one password can be tried from anywhere. The pair above is Fortify’s default.
FAQ#
How do I rate limit Fortify login attempts?
Fortify's login limiter is five attempts a minute. The Vue page shows the message on the username field.
What goes wrong with Laravel login rate limit?
Many developers raise the limit until the lockout "goes away". Do not clear cookies to bypass it.
