Search code examples
laravelthrottlingrate-limiting

should i use throttle or cookie and ip for access limit to login with sms

I have register/login with SMS on my website. I want to limit number of tries by a user for register or login attempts. They should be able to try 20 time per day for registering or login to website.

What is the best way to impelement this? I have tried using

  • laravel throttle middleware
  • cookie and ip address of user

to count number of tries. which one should i stick to? or there is better solution?

Solution

  • The throttle middleware was built exactly for this, so I would stick with that. The 20-times per day limit could be counted on the User model. You would need to schedule a cron job to reset it to 0 after 24h, though. For more info on rate-limiting, see the documentation.