> For the complete documentation index, see [llms.txt](https://vladimirkostikov.gitbook.io/laraboom/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vladimirkostikov.gitbook.io/laraboom/http/10-http-guards.md).

# 10. Validation and HTTP guards

This chapter is about the attributes that wrap the request handler. `#[Check]`, `#[Throttle]`, `#[Idempotent]`, `#[Atomic]`.

## Check. Input validation

```php
#[Check([
    'email' => ['required', 'email'],
    'password' => ['required', 'string'],
])]
public function login(Request $request, array $data): mixed
```

The rules are the plain Laravel validator. On an error the web side gets a redirect back with errors. JSON gets a 422.

### Validated and array

```php
use LaraBoom\Http\Validated;

public function register(Request $request, Validated $data): mixed
{
    $row = $this->demos->query()->create([
        'name' => $data->string('name'),
        'email' => $data->string('email'),
        'password' => $data->string('password'),
        // ...
    ]);
}
```

`Validated` is convenient for typed access. `array $data` is a plain array.

In Resource CRUD the main validation comes from the Field rules. `#[Check]` is used more often on Paths and custom actions.

### The check() helper

Outside an HTTP attribute:

```php
use function LaraBoom\Author\check;

$payload = check($input, [
    'title' => ['required', 'string', 'max:255'],
]);
```

## Throttle. Rate limit

```php
#[Throttle(60, 1)]
#[Throttle(int $maxAttempts = 60, int $decayMinutes = 1, ?string $prefix = null)]
```

Demo examples:

```php
#[Throttle(10, 1)]   // login
#[Throttle(5, 1)]    // register
#[Throttle(30, 1)]   // ping
#[Throttle(60, 1)]   // echo API
```

On excess the response is 429. The prefix lets you split counters when several actions share a similar key.

## Idempotent. Idempotent POSTs

```php
#[Idempotent]
#[Idempotent(int $ttlSeconds = 86400)]
```

The client sends a header:

```
Idempotency-Key: <unique operation key>
```

A repeat with the same key within the TTL returns the previous outcome and does not run the handler again. Critical for payments, pings with side effects and the "clicked twice" case.

In Demo:

```php
#[Post('/action/ping', name: 'demo.ping')]
#[Atomic]
#[Idempotent]
#[Throttle(30, 1)]
#[Check(['message' => ['nullable', 'string', 'max:200']])]
public function ping(Validated $data): mixed
```

The middleware alias is registered by the package (`idempotent:{ttl}`).

## Atomic. Transaction

```php
#[Atomic]
public function register(Request $request, Validated $data): mixed
```

The handler runs inside `DB::transaction`. An error rolls the changes back. Put it on operations where several records must appear together. Registration plus related rows, a compound update.

You can combine it with Resource lifecycle hooks. Do not wrap long external calls (HTTP to a payment provider) inside a long transaction without a reason.

## The order of thinking

A typical safe Path method:

1. `only` and `#[Allow]` answer who
2. `#[Throttle]` answers how often
3. `#[Idempotent]` handles a repeated key
4. `#[Check]` answers what is in the body
5. `#[Atomic]` handles write atomicity
6. the method body does the business steps (`note`, `fire`, `go` and others)

## Request id and logs

The package sets a request id. The `note()` helper mixes it into the context when the header or attribute is there. Handy for stitching the logs of one HTTP call together with a job that left the handler.

## CSRF and API

|                 | Web Path                        | `/api` API                       |
| --------------- | ------------------------------- | -------------------------------- |
| CSRF            | needed for cookie session POSTs | no (JSON API stack)              |
| Idempotency-Key | optional                        | optional                         |
| Throttle        | yes                             | yes                              |
| Check           | yes                             | yes on custom methods and fields |

Next up is [Helpers, jobs, mail, notices](/laraboom/application-behavior/11-side-effects.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://vladimirkostikov.gitbook.io/laraboom/http/10-http-guards.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.