Rate limiting in FastAPI - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when the rate limit is exceeded in this FastAPI endpoint?

Consider this FastAPI endpoint using a simple rate limiter that allows 3 requests per minute per client IP.

from fastapi import FastAPI, Request, HTTPException
from time import time

app = FastAPI()

request_times = {}

@app.get("/data")
async def get_data(request: Request):
    ip = request.client.host
    now = time()
    window = 60
    limit = 3
    times = request_times.get(ip, [])
    times = [t for t in times if now - t < window]
    if len(times) >= limit:
        raise HTTPException(status_code=429, detail="Too many requests")
    times.append(now)
    request_times[ip] = times
    return {"message": "Success"}

What will the client receive on the 4th request within one minute?

FastAPI

from fastapi import FastAPI, Request, HTTPException
from time import time

app = FastAPI()

request_times = {}

@app.get("/data")
async def get_data(request: Request):
    ip = request.client.host
    now = time()
    window = 60
    limit = 3
    times = request_times.get(ip, [])
    times = [t for t in times if now - t < window]
    if len(times) >= limit:
        raise HTTPException(status_code=429, detail="Too many requests")
    times.append(now)
    request_times[ip] = times
    return {"message": "Success"}

A The client receives a JSON response with {"message": "Success"} on all requests.

B The client receives an HTTP 429 error with detail "Too many requests" on the 4th request within one minute.

C The client receives an HTTP 500 Internal Server Error on the 4th request.

D The client receives an HTTP 404 Not Found error on the 4th request.

💡 Hint

Think about what happens when the number of requests exceeds the limit in the code.

The code tracks request times per IP and raises an HTTPException with status 429 when the limit is reached. So the 4th request within one minute triggers this exception, returning a 429 error.

📝 Syntax

intermediate

Identify the syntax error in this FastAPI rate limiting snippet

Which option correctly fixes the syntax error in this code snippet?

from fastapi import FastAPI, Request, HTTPException

app = FastAPI()

@app.get("/limit")
async def limit(request: Request):
    ip = request.client.host
    if ip not in request_times
        request_times[ip] = []
    return {"status": "ok"}

FastAPI

from fastapi import FastAPI, Request, HTTPException

app = FastAPI()

@app.get("/limit")
async def limit(request: Request):
    ip = request.client.host
    if ip not in request_times
        request_times[ip] = []
    return {"status": "ok"}

A Indent the return statement inside the if block.

B Replace 'not in' with 'notin' in the if statement.

C Add a colon at the end of the if statement line: if ip not in request_times:

D Change 'request_times' to 'request_times()' in the if statement.

💡 Hint

Python requires a colon at the end of if statements.

The if statement is missing a colon at the end, which causes a syntax error. Adding ':' fixes it.

❓ state_output

advanced

What is the value of request_times after 3 requests from the same IP within 30 seconds?

Given this code snippet:

from fastapi import FastAPI, Request
from time import time

app = FastAPI()
request_times = {}

@app.get("/check")
async def check(request: Request):
    ip = request.client.host
    now = time()
    window = 60
    times = request_times.get(ip, [])
    times = [t for t in times if now - t < window]
    times.append(now)
    request_times[ip] = times
    return {"count": len(times)}

If the same client IP makes 3 requests within 30 seconds, what will be the value of request_times[ip] after the third request?

FastAPI

from fastapi import FastAPI, Request
from time import time

app = FastAPI()
request_times = {}

@app.get("/check")
async def check(request: Request):
    ip = request.client.host
    now = time()
    window = 60
    times = request_times.get(ip, [])
    times = [t for t in times if now - t < window]
    times.append(now)
    request_times[ip] = times
    return {"count": len(times)}

A A list of 4 timestamps including an extra one from before.

B A list of 1 timestamp, the last request time only.

C An empty list because old timestamps are removed.

D A list of 3 timestamps, each less than 60 seconds old.

💡 Hint

Consider how the code filters timestamps and adds the current time.

The code keeps timestamps within the last 60 seconds and adds the current time. After 3 requests within 30 seconds, all 3 timestamps remain in the list.

🔧 Debug

advanced

Why does this FastAPI rate limiter not reset counts after 1 minute?

Consider this code snippet:

from fastapi import FastAPI, Request, HTTPException
from time import time

app = FastAPI()
request_counts = {}

@app.get("/limit")
async def limit(request: Request):
    ip = request.client.host
    count, start = request_counts.get(ip, (0, time()))
    if time() - start > 60:
        count = 0
        start = time()
    count += 1
    if count > 5:
        raise HTTPException(status_code=429, detail="Too many requests")
    request_counts[ip] = (count, start)
    return {"count": count}

Why might the count never reset after 1 minute?

FastAPI

from fastapi import FastAPI, Request, HTTPException
from time import time

app = FastAPI()
request_counts = {}

@app.get("/limit")
async def limit(request: Request):
    ip = request.client.host
    count, start = request_counts.get(ip, (0, time()))
    if time() - start > 60:
        count = 0
        start = time()
    count += 1
    if count > 5:
        raise HTTPException(status_code=429, detail="Too many requests")
    request_counts[ip] = (count, start)
    return {"count": count}

A Because the start time is reset inside the if block but the dictionary is updated after incrementing count, causing inconsistent timing.

B Because the count variable is never incremented.

C Because the dictionary request_counts is never updated.

D Because the time() function returns a constant value.

💡 Hint

Look at when the start time is updated and when the dictionary is updated.

The start time is reset inside the if block, but count is incremented before updating the dictionary. This causes the timing window to be inconsistent, so the count may not reset as expected.

🧠 Conceptual

expert

Which approach best ensures accurate distributed rate limiting in FastAPI?

You want to implement rate limiting in a FastAPI app deployed on multiple servers behind a load balancer. Which approach below best ensures accurate rate limiting across all servers?

A Use a shared external store like Redis to track request counts and timestamps centrally.

B Use an in-memory dictionary on each server to track request counts per IP separately.

C Use client-side cookies to store request counts and enforce limits on the client.

D Rely on the load balancer to block requests after a fixed number per server.

💡 Hint

Think about how to share state across multiple servers.

Using a shared external store like Redis allows all servers to access and update the same rate limit data, ensuring accurate limits across distributed instances.