Custom exception message when using middleware api.throttle

[Luddinus]

Hi,

I'm using the api.throttle middleware when a user tries to login the application.

If he passed the rate limit, the middleware throws an HttpException, with the message "You have exceed your rate limit"

api/src/Http/Middleware/RateLimit.php

Line 67 in b049120

throw new HttpException(403, 'You have exceeded your rate limit.', null, $this->getHeaders());

So, how can I change that message ONLY in this route? I know I can do custom exceptions, but in this case, the Exception is already fired so, any ideas?

Thx.

[Luddinus]

Well, this is what I've done, maybe it could be better?

I create a new middleware

// my api provider...
public function boot()
{
   $this->app['router']->middleware(
       'api.login.throttle', LoginRateLimit::class
   );
}

Then I extend that class to dingo's RateLimit Middleware

class LoginRateLimit extends RateLimit
{
    public function handle($request, Closure $next)
    {
        try {
            return parent::handle($request, $next);
        } catch (HttpException $e) {
            throw new HttpException(403, 'Too many attempts blablabla...', null, $this->getHeaders());
        }
    }
}

And of course the route has my custom middleware instead of "api.throttle"

[catalinux]

I am not sure if it works, but you should try the following

• setup a custom handler for that exception
• in your handler check the route and abort(403, 'Custom message');

[Luddinus]

@catalinux You mean check the current route url? It seems like at the end of the date I would have a lot of conditionals...

[hskrasek]

@Luddinus At the moment the best way to handle this is with a custom middleware, just like you've done. Down the line we might add a language file so that you can edit the messages there.

[catalinux]

@Luddinus : sorry but I can't understand what are you saying, In the first post you said you want to change that message for a specific route only.

[Luddinus]

@catalinux Let me explain better.

The "api.throttle" middleware always returns the same exception message ("You have exceeded your rate limit.").

In this particular situation (too many attemps on login), I want to change that message and show something like "Too many attempts...".

There could be a lot of situations that you use this middleware and the message will always be the same.

What you were saying (what I understood) is to do this?

// some provider
public function boot(DingoExceptionHandler $handler)
{
   $handler->register(function (HttpException $e) {
      if (array_key_exists('X-RateLimit-Limit', $e->getHeaders()) {
         // we know that the exception thrown is a "throttle exception"
         if (Request::is('api/v1/login')) {
            return ['message' => 'Too many attempts'];
         }

         // other conditionals...
      }

   });
}

If this is what you meant, I don't feel comfortable with those conditionals...

It is true that in my first post I was asking for an specific route, but there has to be a better way to do this.

My way is the Middleware, like I did and it seems to be "Ok" from now (like @hskrasek said). But the "problem" still there, I would have to create a specific middleware for each custom throttle message I want.

[catalinux]

@Luddinus I ussualu add my exception handler in AppServiceProvider. (in boot method)

Something like that

$this->app->make('api.exception')->register(function (HttpException $e) {

            if (app('Dingo\Api\Routing\Router')->currentRouteName() === 'api.login' && $e->getStatusCode() === 403 && $e->getTrace()[0]['class'] == RateLimit::class) {
                abort(403, "My Message");
            }
        });

[Luddinus]

Thx @catalinux, that will work I guess but are you "happy" with that? I mean, it does not seem too "laravelish"... too many conditions (three in that case)...

[catalinux]

@Luddinus :) good question

For me it's 'laravelish' because:

• it uses app container
• it uses router API

Other way would be

• to create a new Middleware for RateLimit that would allow paramers so you could write somehting like

Route::post('login', ['middleware' => 'ratelimig:custommessage, function () {
return view('company.admin');
});

but I am not sure if would be a really success

[catalinux]

Feweer conditions wouldbe if the RateLimit middleware would trow a specific RateLimitException that would encapsulate also the request. This way, you would check

• exception class
• and get request rout from the exception

[catalinux]

Btw, there is a thread about adding a custum exception: #1158 (comment)

[hskrasek]

@catalinux Not exactly. Still gonna throw the HttpException, but with RFC required headers for throttling. Best way is to make a new middleware that extends the packages, and basically try/catch the exception and re-throw it.

[catalinux]

@hskrasek Sorry for missunderstanding. I saw this: 887732d