Skip to content

[6.x] Allow middleware to be added to frontend form and auth routes#14475

Open
ryanmitchell wants to merge 3 commits intostatamic:6.xfrom
ryanmitchell:feature/rate-limiting
Open

[6.x] Allow middleware to be added to frontend form and auth routes#14475
ryanmitchell wants to merge 3 commits intostatamic:6.xfrom
ryanmitchell:feature/rate-limiting

Conversation

@ryanmitchell
Copy link
Copy Markdown
Contributor

One thing thats come up for us a few times now on penetration tests is rate limiting on front end auth end points and form end points. Its possible to hack around this by doing something in your AppServiceProvider like:

        $this->app->booted(function () {
            $routes = app('router')->getRoutes()->get('POST');
            $routes['!/auth/login']->middleware('auththrottle:4,1');
            $routes['!/auth/password']->middleware('auththrottle:4,1');
            $routes['!/auth/register']->middleware('auththrottle:4,1');
        });

But it would be nice to have the ability to add middleware to these routes supported natively, which this PR attempts to do by adding two config keys to config/routes.php:

  • auth_middleware — applied to the entire !/auth/* route group (login, register, password reset, 2FA, etc.)
  • forms_middleware — applied to the POST !/forms/{form} route

Usage example:

  // config/statamic/routes.php                                                                                                                                                                                                                                                                    
  'auth_middleware' => ['throttle:4,1'],                                                                                                                                                                                                                                                         
  'forms_middleware' => ['throttle:20,1'],    

I thought it better to allow middleware to be added, rather than just limiting it to rate limiting.

Closes statamic/ideas#1233

@ryanmitchell ryanmitchell changed the title [6.x] Allow configs to be added to frontend form and auth end routes [6.x] Allow middleware to be added to frontend form and auth end routes Apr 10, 2026
@ryanmitchell ryanmitchell changed the title [6.x] Allow middleware to be added to frontend form and auth end routes [6.x] Allow middleware to be added to frontend form and auth routes Apr 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Form rate limiting

1 participant