Security: No rate limiting configured for any routes

[Snider]

Description

The template has no rate limiting configured for any routes, including the welcome page and health endpoint. While this may be acceptable for a template, it leaves applications vulnerable to abuse until developers add rate limiting themselves.

Files affected:

• routes/web.php - No throttle middleware
• routes/api.php - Empty file, but module routes will inherit no rate limits
• app/Providers/AppServiceProvider.php - No rate limiters defined

Impact

Applications built from this template will be vulnerable to:

• Denial of service attacks
• Brute force attacks on login endpoints (when added)
• API abuse
• Resource exhaustion

Recommendation

1. Define default rate limiters in AppServiceProvider:

use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Support\Facades\RateLimiter;
use Illuminate\Http\Request;

public function boot(): void
{
    RateLimiter::for('web', function (Request $request) {
        return Limit::perMinute(60)->by($request->ip());
    });

    RateLimiter::for('api', function (Request $request) {
        return Limit::perMinute(60)->by($request->user()?->id ?: $request->ip());
    });
}

2. Apply throttle middleware to API routes in module documentation
3. Document rate limiting configuration in docs/security.md

References

• docs/security.md mentions rate limiting but it's not implemented
• Laravel Rate Limiting: https://laravel.com/docs/rate-limiting