Challenge 1 / 2

We put the limiter inside the block that runs only when the form is submitted and valid, right before the new user is created:

if ($form->isSubmitted() && $form->isValid()) {
    $limit = $limiterFactory->create($request->getClientIp())->consume();

    if (!$limit->isAccepted()) {
        // ...
    }

    // ... create the user
}

Why not consume a token as soon as the form is submitted?

consume() throws if the form has validation errors, so it can only be called on a valid form.

Our rule allows one registration every 10 minutes - if invalid submissions counted too, a single typo in the password would lock someone out for the next 10.

Tokens consumed before validation are refunded automatically, so calling it earlier would make no difference.

The client IP isn't available until the form has been validated.

Rewatch the video