fix: Move RateLimiter configuration to AppServiceProvider #205
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The RateLimiter facade was being called in bootstrap/app.php before the application was fully booted, causing a 'facade root has not been set' fatal error. This prevented Laravel from starting correctly. Moved the RateLimiter::for() calls from bootstrap/app.php to the AppServiceProvider::boot() method where facades are available. Fixes the application crash and allows Laravel Boost MCP to start.
💡 Tip: Consider Using Draft PRsBenefits of opening PRs as drafts initially:
How to convert:
This is just a friendly reminder - feel free to continue as is! 😊 |
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
Copilot finished reviewing on behalf of
kevalyq
November 22, 2025 13:48
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes a critical application startup error by relocating rate limiter configuration from bootstrap/app.php to AppServiceProvider::boot(). The issue occurred because facades are not available during the withMiddleware() callback in the bootstrap phase, causing a "RuntimeException: A facade root has not been set" error.
Key Changes:
- Moved
RateLimiter::for()calls frombootstrap/app.phptoAppServiceProvider::boot()where facades are properly initialized - Updated imports accordingly in both files
- No functional changes to rate limiting behavior
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| bootstrap/app.php | Removed rate limiter configuration and related imports from withMiddleware() callback to prevent facade initialization errors |
| app/Providers/AppServiceProvider.php | Added rate limiter definitions to boot() method with proper facade support, maintaining identical rate limiting logic |
Co-authored-by: Copilot <175728472+Copilot[bot]@users.noreply.github.com>
The method signature is perMinutes($decayMinutes, $maxAttempts). Therefore perMinutes(60, 5) means '5 attempts per 60 minutes' which is correct. The previous commit incorrectly changed it to perMinutes(5, 60) which would mean '60 attempts per 5 minutes'.
This was referenced Nov 24, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
The application was crashing with a fatal error:
RuntimeException: A facade root has not been setinbootstrap/app.phpat line 34. This prevented Laravel from starting correctly and also broke Laravel Boost MCP.The error occurred because
RateLimiter::for()was being called in thewithMiddleware()callback inbootstrap/app.phpbefore the application was fully booted, making facades unavailable at that point in the application lifecycle.Solution
Moved the
RateLimiter::for()calls frombootstrap/app.phptoAppServiceProvider::boot()where facades are properly initialized and available.Changes
bootstrap/app.php
RateLimiter::for()calls fromwithMiddleware()callbackIlluminate\Cache\RateLimiting\Limit,Illuminate\Http\Request,Illuminate\Support\Facades\RateLimiterapp/Providers/AppServiceProvider.php
Limit,Request, andRateLimiterboot()method:apirate limiter: 60 requests per minute per user/IPpassword-resetrate limiter: 5 requests per 60 minutes per IPVerification
php artisan --versionworksImpact
This is a critical bugfix that restores application functionality. No behavior changes - rate limiting configuration remains identical, just moved to the correct location in the application lifecycle.