Laravel Dingo框架Rate Limiting失效及中间件未绑定问题求助

Hey there, let's break down why your throttle middleware isn't attaching to your route and not enforcing the request limits you set. From what you described, the root issue is that the middleware isn't being recognized by Dingo API, which is why it doesn't show up when you run php artisan api:route. Here's how to fix this step by step:

1. Check Middleware Alias and Registration #

First, make sure the throttle middleware is properly registered in your Laravel app. Open app/Http/Kernel.php and verify the $routeMiddleware array includes the default Laravel throttle alias:

protected $routeMiddleware = [
    // ... other middleware aliases
    'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
];

If you were using api.throttle as the middleware alias, double-check that this alias exists here (it’s not a default one, so you’d have to define it yourself if you want to use it). For most cases, sticking with the default throttle alias is safer.

2. Fix Route Middleware Syntax #

Your original route code uses separate limit and expires keys outside the middleware definition, which isn’t how Dingo API expects throttle parameters to be passed. You need to embed the limits directly into the middleware string or pass them as an array to the middleware.

Option 1: Embed Parameters in Middleware String (Recommended) #

This is the standard Laravel syntax that works seamlessly with Dingo API:

$api->group(['prefix' => 'auth'], function ($api) {
    $api->post('checkUser', [
        'middleware' => 'throttle:3,20', // Format: throttle:limit,expires_in_minutes
        'uses' => 'Auth\LoginController@checkUser'
    ]);
});

Option 2: Pass Parameters as Array #

If you prefer the array syntax (supported in newer Dingo versions), structure it like this:

$api->group(['prefix' => 'auth'], function ($api) {
    $api->post('checkUser', [
        'middleware' => ['throttle' => ['limit' => 3, 'expires' => 20]],
        'uses' => 'Auth\LoginController@checkUser'
    ]);
});

3. Clear Route Cache #

Sometimes old route cache can prevent new middleware bindings from showing up. Run this command to clear the cache:

php artisan route:clear

4. Verify the Middleware is Bound #

After making the changes, re-run php artisan api:route and check if the checkUser route now lists the throttle middleware with your specified limits. If it does, your setup is correct.

5. Test the Throttle Enforcement #

Once the middleware is bound, send more than 3 requests to the /auth/checkUser endpoint within 20 minutes. You should receive a 429 Too Many Requests response, confirming the throttle is working as expected.

内容的提问来源于stack exchange，提问作者Ahmad Badpey