Rate limiting in FastAPI - Performance & Optimization

Performance: Rate limiting

MEDIUM IMPACT

Rate limiting affects server response time and user interaction speed by controlling request frequency to avoid overload.

Controlling API request frequency to prevent server overload

FastAPI

from fastapi import FastAPI, Request
from starlette.responses import JSONResponse
import time

app = FastAPI()

rate_limits = {}

@app.middleware("http")
async def fixed_window_rate_limit(request: Request, call_next):
    client_ip = request.client.host
    current_time = int(time.time())
    window = current_time // 60  # 1-minute window
    key = f"{client_ip}:{window}"
    count = rate_limits.get(key, 0)
    if count >= 100:
        return JSONResponse(status_code=429, content={"detail": "Too many requests"})
    rate_limits[key] = count + 1
    response = await call_next(request)
    return response

Uses per-client fixed time windows with expiration, limiting requests fairly and avoiding permanent blocks.

📈 Performance GainReduces unnecessary blocking, keeps server responsive, improves INP by handling bursts efficiently

Controlling API request frequency to prevent server overload

FastAPI

from fastapi import FastAPI, Request
from starlette.responses import JSONResponse

app = FastAPI()

@app.middleware("http")
async def naive_rate_limit(request: Request, call_next):
    # Simple in-memory counter without expiration
    if not hasattr(app.state, 'counter'):
        app.state.counter = 0
    app.state.counter += 1
    if app.state.counter > 100:
        return JSONResponse(status_code=429, content={"detail": "Too many requests"})
    response = await call_next(request)
    return response

This naive approach uses a global counter without expiration, causing permanent blocking after limit is reached and no per-user control.

📉 Performance CostBlocks requests unnecessarily, causing poor INP and potential server resource waste

Performance Comparison

Pattern	DOM Operations	Reflows	Paint Cost	Verdict
Naive global counter	0 (server-side only)	0	0	[X] Bad
Per-client fixed window	0 (server-side only)	0	0	[OK] Good

Rendering Pipeline

Rate limiting runs on the server before response generation, affecting how quickly the server can send responses back to the browser.

→Server Processing

→Network Response

⚠️ BottleneckServer Processing when rate limiting logic is inefficient or blocks too many requests

Core Web Vital Affected

INP

Rate limiting affects server response time and user interaction speed by controlling request frequency to avoid overload.

Optimization Tips

1Avoid global counters without expiration to prevent permanent blocking.

2Implement per-client rate limits with time windows to balance fairness and performance.

3Monitor 429 responses and server response times to ensure rate limiting does not degrade user experience.

Performance Quiz - 3 Questions

What is the main performance risk of a naive global counter for rate limiting in FastAPI?

A It causes excessive CSS recalculations

B It increases DOM reflows on the client

C It can permanently block all users after limit is reached

D It reduces network bandwidth

DevTools: Network

How to check: Open DevTools, go to Network tab, make rapid repeated requests to API endpoint, observe response status codes and timing.

What to look for: Look for 429 status codes indicating rate limiting and check response times to ensure server responds quickly without delays.

Practice

1.

What is the main purpose of rate limiting in a FastAPI application?

easy

A. To speed up database queries

B. To control how often users can call API endpoints

C. To add more routes automatically

D. To change the API response format

Solution

1. Step 1: Understand rate limiting concept

   Rate limiting restricts the number of requests a user can make in a time period.

2. Step 2: Identify the purpose in FastAPI

   It protects the app from overload and abuse by controlling request frequency.

3. Final Answer:

   To control how often users can call API endpoints -> Option B

4. Quick Check:

   Rate limiting = Control request frequency [OK]

Hint: Rate limiting means controlling request frequency [OK]

Common Mistakes:

• Thinking it speeds up queries
• Confusing with routing features
• Assuming it changes response format

2.

Which of the following is the correct way to import a rate limiter middleware in FastAPI?

from fastapi import FastAPI
from _____ import RateLimiterMiddleware

app = FastAPI()
app.add_middleware(RateLimiterMiddleware, max_requests=5, window_seconds=60)

easy

A. fastapi_utils

B. fastapi.middleware

C. fastapi_rate_limit

D. fastapi_limiter

Solution

1. Step 1: Recall FastAPI rate limiting libraries

   FastAPI commonly uses the external package 'fastapi_limiter' for rate limiting middleware.

2. Step 2: Match import statement

   The correct import is from 'fastapi_limiter' to get RateLimiterMiddleware.

3. Final Answer:

   fastapi_limiter -> Option D

4. Quick Check:

   RateLimiterMiddleware import = fastapi_limiter [OK]

Hint: Rate limiter middleware comes from fastapi_limiter package [OK]

Common Mistakes:

• Using built-in fastapi.middleware (no rate limiter there)
• Confusing with unrelated packages
• Misspelling package names

3.

Given this FastAPI code snippet using fastapi_limiter:

from fastapi import FastAPI
from fastapi_limiter import FastAPILimiter
from fastapi_limiter.depends import RateLimiter
import aioredis

app = FastAPI()

@app.on_event("startup")
async def startup():
    redis = await aioredis.from_url("redis://localhost")
    await FastAPILimiter.init(redis)

@app.get("/items", dependencies=[Depends(RateLimiter(times=3, seconds=10))])
async def read_items():
    return {"message": "Success"}

What happens if a user calls /items 4 times within 10 seconds?

medium

A. The server crashes due to Redis error

B. All 4 requests succeed with message 'Success'

C. The 4th request is blocked with a 429 Too Many Requests error

D. The 4th request is delayed but eventually succeeds

Solution

1. Step 1: Understand RateLimiter parameters

   RateLimiter(times=3, seconds=10) allows 3 requests every 10 seconds per user.

2. Step 2: Analyze 4 requests in 10 seconds

   The 4th request exceeds the limit and triggers a 429 error response.

3. Final Answer:

   The 4th request is blocked with a 429 Too Many Requests error -> Option C

4. Quick Check:

   Requests > limit = 429 error [OK]

Hint: Requests over limit cause 429 error response [OK]

Common Mistakes:

• Assuming all requests succeed
• Thinking server crashes on limit
• Believing requests get delayed instead of blocked

4.

Identify the error in this FastAPI rate limiting setup:

from fastapi import FastAPI
from fastapi_limiter import FastAPILimiter
import aioredis

app = FastAPI()

@app.on_event("startup")
async def startup():
    redis = aioredis.from_url("redis://localhost")
    await FastAPILimiter.init(redis)

@app.get("/data", dependencies=[Depends(RateLimiter(times=2, seconds=5))])
async def get_data():
    return {"data": "info"}

medium

A. Missing await before aioredis.from_url call

B. RateLimiter times parameter must be 5 or more

C. FastAPILimiter.init should not be awaited

D. Redis URL must use http:// instead of redis://

Solution

1. Step 1: Check aioredis.from_url usage

   aioredis.from_url is an async function and must be awaited to get the Redis client.

2. Step 2: Identify missing await

   The code calls aioredis.from_url without await, causing a coroutine object instead of Redis client.

3. Final Answer:

   Missing await before aioredis.from_url call -> Option A

4. Quick Check:

   Async calls need await [OK]

Hint: Always await async Redis client creation [OK]

Common Mistakes:

• Forgetting await on async functions
• Misunderstanding RateLimiter parameters
• Using wrong Redis URL scheme

5.

You want to limit users to 10 requests per minute globally across multiple FastAPI instances behind a load balancer. Which setup is best?

1. Use in-memory counters in each instance
2. Use Redis with fastapi_limiter shared by all instances
3. Use local file storage for counts
4. Disable rate limiting

hard

A. Option 2: Use Redis with fastapi_limiter shared by all instances

B. Option 1: Use in-memory counters in each instance

C. Option 3: Use local file storage for counts

D. Option 4: Disable rate limiting

Solution

1. Step 1: Understand distributed rate limiting need

   Multiple FastAPI instances require a shared store to track request counts globally.

2. Step 2: Evaluate options

   In-memory counters are local to each instance, causing inconsistent limits. Local files are not suitable for concurrency. Disabling rate limiting removes protection.

3. Step 3: Choose Redis shared by all instances

   Redis is a fast, centralized store that all instances can use to enforce limits consistently.

4. Final Answer:

   Option 2: Use Redis with fastapi_limiter shared by all instances -> Option A

5. Quick Check:

   Distributed rate limiting needs shared Redis [OK]

Hint: Use shared Redis for consistent limits across instances [OK]

Common Mistakes:

• Using local memory causing inconsistent limits
• Using file storage which is slow and unsafe
• Disabling rate limiting ignoring abuse risks