Throttle with Precognition

[joaopalopes24]

I have one post route that uses the precognition:

Route::post('forgot-password', [Auth\PasswordResetLinkController::class, 'store'])->middleware('throttle:6,1');

Since this route has the throttle too, if I call this route, even with errors, the rate limiter is filled. I think you could create anything to bypass the throttle when the request is for precognition.

Route::post('forgot-password', [Auth\PasswordResetLinkController::class, 'store'])->middleware('throttle:6,1')->ignorePrecognition();

[elzdave]

Agree with this idea. I hope it can be implemented soon.

I also encounter this problem with my Precognitive routes, and for now, my workaround was checking whether the request has Precognition header, something like this on boot method at RouteServiceProvider.php :

public function boot(): void
{
  RateLimiter::for('my-throttled-routes', function (Request $request) {
      if (! $request->hasHeader('Precognition')) {
          // set the $decayMinutes and $maxAttempts to your needs
          return Limit::perMinutes($decayMinutes = 5, $maxAttempts = 15)->by('your-defined-throttle-key');
      }
  });

  // the rest of boot method
}

So in the web.php, we just use the rate limiter like usual :

Route::middleware('throttle:my-throttled-routes')->group(function() {
  // define your precognitive and throttled routes here
}

[nsadeghieh]

Using request headers for checking precognition is not a good idea, as they can be easily modified to evade restrictions.
Instead, consider using the attempt method from RateLimiter class for rate limiting specific parts of code instead of throttling the entire route.

[hasan-ozbey]

FYI same goes on for the $request->isPrecognition() method, I easily tricked it by using false request headers.