Throttling for rate limiting in Django - Mini Project: Build & Apply

Throttling for rate limiting in Django

📖 Scenario: You are building a simple Django API that serves user data. To protect your API from too many requests, you want to add throttling to limit how often a user can call the API.

🎯 Goal: Build a Django REST Framework API view with throttling enabled to limit requests to 5 per minute per user.

📋 What You'll Learn

Create a Django REST Framework API view that returns a simple JSON response.

Add a throttle class to limit requests to 5 per minute per user.

Configure the throttle rate in Django settings.

Apply the throttle class to the API view.

💡 Why This Matters

🌍 Real World

APIs often need protection from too many requests to avoid overload or abuse. Throttling helps keep services stable and fair for all users.

💼 Career

Understanding how to implement throttling is important for backend developers working with APIs to ensure performance and security.

1

Create a simple API view

Create a Django REST Framework API view called UserDataView that returns a JSON response with {"message": "Hello, user!"}. Use APIView and define a get method that returns Response({"message": "Hello, user!"}).

Django

from rest_framework.views import APIView
from rest_framework.response import Response

# Your code here

Hint

Import APIView and Response from rest_framework. Define a class UserDataView inheriting from APIView. Add a get method that returns the JSON response.

2

Set throttle rate in settings

In your Django settings.py, add a dictionary called REST_FRAMEWORK with a key 'DEFAULT_THROTTLE_RATES' set to {'user': '5/minute'} to limit users to 5 requests per minute.

Django

from rest_framework.views import APIView
from rest_framework.response import Response

class UserDataView(APIView):
    def get(self, request):
        return Response({"message": "Hello, user!"})

# In settings.py
REST_FRAMEWORK = {
    # Your code here
}

Hint

In settings.py, define REST_FRAMEWORK dictionary with DEFAULT_THROTTLE_RATES key. Set the user throttle rate to '5/minute'.

3

Import and add throttle class

Import UserRateThrottle from rest_framework.throttling. Add a class attribute throttle_classes to UserDataView and set it to a list containing UserRateThrottle.

Django

from rest_framework.views import APIView
from rest_framework.response import Response
from rest_framework.throttling import UserRateThrottle

class UserDataView(APIView):
    # Your code here
    def get(self, request):
        return Response({"message": "Hello, user!"})

# In settings.py
REST_FRAMEWORK = {
    'DEFAULT_THROTTLE_RATES': {
        'user': '5/minute'
    }
}

Hint

Import UserRateThrottle and add throttle_classes = [UserRateThrottle] inside UserDataView.

4

Add URL pattern for the API view

In your Django app's urls.py, import UserDataView and add a URL pattern path('user-data/', UserDataView.as_view()) to expose the API at /user-data/.

Django

from django.urls import path
from .views import UserDataView

urlpatterns = [
    # Your code here
]

Hint

Import UserDataView from views. Add a path for 'user-data/' that calls UserDataView.as_view().

Practice

1. What is the main purpose of throttling in Django REST Framework?

easy

A. To cache API responses for faster access

B. To limit the number of requests a user can make in a given time period

C. To authenticate users before accessing the API

D. To speed up the response time of the server

Solution

1. Step 1: Understand throttling concept

   Throttling is designed to control how many requests a user can send to the server in a set time.

2. Step 2: Identify purpose in Django REST Framework

   It prevents abuse by limiting request rates, not speeding responses or authentication.

3. Final Answer:

   To limit the number of requests a user can make in a given time period -> Option B

4. Quick Check:

   Throttling = request limit [OK]

Hint: Throttling controls request counts per time [OK]

Common Mistakes:

• Confusing throttling with authentication
• Thinking throttling speeds up responses
• Mixing throttling with caching

2. Which of the following is the correct way to set a throttle rate of 10 requests per minute in a custom throttle class?

easy

A. rate = '10/minute'

B. rate = '10/second'

C. rate = 'minute/10'

D. rate = '10 requests per minute'

Solution

1. Step 1: Recall throttle rate format

   The rate must be a string with number and time unit separated by a slash, e.g., '10/minute'.

2. Step 2: Match correct syntax

   Only '10/minute' matches the required format; others are invalid or incorrect syntax.

3. Final Answer:

   rate = '10/minute' -> Option A

4. Quick Check:

   Throttle rate format = 'number/time' [OK]

Hint: Throttle rate uses 'number/time' string format [OK]

Common Mistakes:

• Using spaces or words instead of slash format
• Swapping number and time units
• Using unsupported time units

3. Given this view with throttling applied:

from rest_framework.throttling import UserRateThrottle

class MyThrottle(UserRateThrottle):
    rate = '3/minute'

class MyView(APIView):
    throttle_classes = [MyThrottle]

    def get(self, request):
        return Response({'message': 'Hello'})

What happens if a user makes 4 GET requests within one minute?

medium

A. The 4th request is delayed but eventually succeeds

B. All 4 requests succeed with status 200

C. The 4th request is blocked with a 429 Too Many Requests error

D. The server crashes due to too many requests

Solution

1. Step 1: Understand throttle rate and behavior

   The throttle allows 3 requests per minute per user; the 4th exceeds the limit.

2. Step 2: Identify response to exceeding limit

   When limit is exceeded, Django REST Framework returns HTTP 429 error blocking the request.

3. Final Answer:

   The 4th request is blocked with a 429 Too Many Requests error -> Option C

4. Quick Check:

   Requests > rate limit = 429 error [OK]

Hint: Requests over limit get 429 error [OK]

Common Mistakes:

• Assuming all requests succeed
• Thinking requests get delayed instead of blocked
• Believing server crashes on too many requests

4. Identify the error in this custom throttle class:

from rest_framework.throttling import SimpleRateThrottle

class CustomThrottle(SimpleRateThrottle):
    scope = 'custom'

    def get_cache_key(self, request, view):
        return request.user.id

# settings.py
REST_FRAMEWORK = {
    'DEFAULT_THROTTLE_RATES': {
        'custom': '5/minute'
    }
}

medium

A. get_cache_key should return a string, but returns an integer

B. scope should be set to 'rate' instead of 'custom'

C. DEFAULT_THROTTLE_RATES key 'custom' is missing a time unit

D. CustomThrottle must inherit from UserRateThrottle, not SimpleRateThrottle

Solution

1. Step 1: Check get_cache_key return type

   The method returns request.user.id, which is an integer, but cache keys must be strings.

2. Step 2: Validate other parts

   Scope 'custom' matches the throttle rate key, and inheritance from SimpleRateThrottle is valid.

3. Final Answer:

   get_cache_key should return a string, but returns an integer -> Option A

4. Quick Check:

   Cache key must be string [OK]

Hint: Cache keys must be strings, not integers [OK]

Common Mistakes:

• Returning non-string cache keys
• Misnaming throttle scope
• Confusing throttle class inheritance

5. You want to apply different throttle rates for authenticated and anonymous users in Django REST Framework. Which approach correctly implements this?

hard

A. Set a single throttle class with rate '10/minute' and check user status inside get_cache_key

B. Use middleware to block anonymous users after 5 requests per minute instead of throttling classes

C. Apply throttling only to authenticated users by setting throttle_classes conditionally in the view

D. Use two throttle classes: one with 'user' scope for authenticated, one with 'anon' scope for anonymous, and add both to the view's throttle_classes

Solution

1. Step 1: Understand throttling for different user types

   Django REST Framework supports multiple throttle classes to handle different user types separately.

2. Step 2: Apply correct method

   Using two throttle classes with 'user' and 'anon' scopes and adding both to throttle_classes is the standard way.

3. Final Answer:

   Use two throttle classes: one with 'user' scope for authenticated, one with 'anon' scope for anonymous, and add both to the view's throttle_classes -> Option D

4. Quick Check:

   Multiple throttle classes handle user types separately [OK]

Hint: Use separate throttle classes for user and anon [OK]

Common Mistakes:

• Trying to handle both user types in one throttle class
• Using middleware instead of throttle classes
• Conditionally setting throttle_classes in the view