Keep hitting Laravel Cloud rate limits in the Control Panel

[HannesEURESA]

Bug description

When Cloudflare's Rate Limiting is enabled through Laravel Cloud, it becomes impossible to do anything in the Control Panel, and you constantly run up against Cloudflare's challenges. This issue emerged with Statamic Version 6; prior to that, everything worked without any problems.

How to reproduce

Activate Firewall Rate Limiting from Cloudflare through Laravel Cloud Environment.
Any Action or refreshing the Page inside Statamic causeing the challenge Screen from Cloudflare

Logs

Environment

Environment
Laravel Version: 13.11.2
PHP Version: 8.5.0
Composer Version: 2.9.2
Maintenance Mode: OFF
Timezone: Europe/Berlin
Locale: de

Drivers
Cache: redis
Database: mysql
Logs: stack / single
Mail: mailcoach
Queue: sync
Session: database

Storage
public/storage: LINKED

Locales
Installed: cs, da, de, en, nb, nl, nn
LaravelLang\Lang\Plugin: 15.29.5
Locales Version: 2.11.0
Protected: de, en
Publisher Version: 16.8.0

Livewire
Livewire: v4.3.0

Spatie Permissions
Features Enabled: Default
Version: 7.4.1

Statamic
Addons: 8
License Key: Set
Sites: 1
Stache Watcher: Disabled
Static Caching: half
Version: 6.19.0 PRO

Statamic Addons
marcorieser/statamic-live-search: 3.2.0
marcorieser/statamic-livewire: 5.3.1
rias/statamic-redirect: 4.1.9
statamic-rad-pack/runway: 9.4.5
statamic/eloquent-driver: 5.9.0
stillat/antlers-components: 2.8.0
studio1902/statamic-peak-seo: 11.2.0
studio1902/statamic-peak-tools: 9.1.0

Statamic Eloquent Driver
Addon Settings: file
Asset Containers: file
Assets: file
Blueprints: file
Collection Trees: eloquent
Collections: eloquent
Entries: eloquent
Fieldsets: file
Form Submissions: eloquent
Forms: eloquent
Global Sets: file
Global Variables: file
Navigation Trees: eloquent
Navigations: eloquent
Revisions: eloquent
Sites: file
Taxonomies: eloquent
Terms: eloquent
Tokens: file

Installation

Existing Laravel app

Additional details

No response

[duncanmcclean]

Is there any way to know what Laravel Cloud's configured rate limit is? Maybe you can change it.

[HannesEURESA]

There are only those Options

[duncanmcclean]

According to the Laravel Cloud docs, you're limited to 100 requests per minute, per IP address:

---

What are you doing leading up to the challenge? Are you opening up multiple entries, paginating in listings?

[HannesEURESA]

We have multiple Editors working on multiple Entries. No exclusive Settings inside the Control Panel. Sure there are Pagination in the listings, because of the amount of the Entries, which are already created

[HannesEURESA]

Is here any Update? We tested again and the Rate Limiting is still hitting against the Website, if the Authors are working in the Control Panel.

[jasonvarga]

Like Duncan showed, the default rate limit is 100 requests per minute per IP.

If you have multiple editors using the same IP (in the same building, etc) they will get the shared rate limit bucket and it's reasonable that they'd run into it. Click around a few listings, use paginations, load images, etc, it adds up quickly.

Check out the Rate Limiting section of your Laravel Cloud dashboard. They may have a way to customize the rate limits.

[stuartcusackie]

Just to add, I am regularly rate limited by CloudFlare when using the Statamic 6 control panel. I am using Hetzner servers via Forge, not Laravel Cloud. My problem doesn't seem as bad as the OPs. It usually just happens once per day on the first visit to the CP.

[duncanmcclean]

Just to add, I am regularly rate limited by CloudFlare when using the Statamic 6 control panel

What do your rate limiting rules look like in Cloudflare? You can find them under "Domain -> Security -> Security rules".

[stuartcusackie]

Ah I see now that this particular domain has a rate limit rule in place: 50 requests in 10 seconds.

Statamic 5 might have made fewer requests so it was never an issue, but nevermind. I can increase my rate limit on CloudFlare to solve my problem. Thank you!

[HannesEURESA]

As things stand with Laravel Cloud, it isn't easy to increase rate limits, let alone whitelist IPs or exclude specific URLs. You have to switch to a self-hosted Cloudflare setup or a private Cloudflare instance, which complicates things significantly. The question arises: why is this happening now after the switch to Statamic 6, when it wasn't an issue before? Is there any way you can mitigate this on your end?

[duncanmcclean]

I've just opened #15112 which bundles Statamic's icons into a single file, avoiding the need to make a separate request per icon which I suspect was the primary cause of hitting the rate limit so quickly.

You may still run into Cloudflare/Laravel Cloud's rate limits every so often, but hopefully nowhere near as frequently as you do right now. 🙂

[HannesEURESA]

I ran another measurement a short while ago. Here you can see a 3-minute segment of the data, specifically, 424 requests in three minutes. That is just from a single editor. That alone exceeds the limit of 100 requests per minute. What stands out is that the live preview fires off a request for every single keystroke. On top of that, there are all the relationships, which require the transfer of very large amounts of data.
That’s why I don’t think your PR will be sufficient to solve the actual problem. :)