Module throttle 

Laravel’s throttle middleware - a fixed-window request-rate limit, keyed by the caller’s real TCP peer address (ConnectInfo<SocketAddr>, see larust_core::Application::serve()’s into_make_service_with_connect_info wiring), never a client-supplied header like X-Forwarded-For - this framework has no “trusted proxy” concept to validate such a header against, so trusting it would make the limiter trivially bypassable (a different value per request) while looking like it works.

Rejects with 429 Too Many Requests plus a Retry-After header once a key’s bucket is exhausted, matching Laravel’s own ThrottleRequests response shape. Hand-rolled rather than built on tower::limit (present in this workspace’s dependency tree only via tower’s default features; its RateLimit service isn’t Clone, failing Router:: middleware()’s bound without extra wrapping, and it has no per-key bucketing at all) or a new dependency like governor - this mirrors csrf.rs’s own hand-written axum::middleware::from_fn-style shape instead, the established house style for this kind of thing.

Structs

ThrottleState

pub only because it has to appear in per/per_minute’s public return type (see that doc comment) - every field stays private, so nothing outside this module can construct or inspect one.

Functions

per

max_requests per window - the general form behind per_minute. Usable via Router::middleware(...) the same way csrf::verify/ DefaultBodyLimit::max(...) already are.

per_minute

max_requests per rolling minute - Laravel’s own common default (throttle:60,1) when a route doesn’t specify its own limit.