Rate limiting in FastAPI - Mini Project: Build & Apply

Rate Limiting with FastAPI

📖 Scenario: You are building a simple API with FastAPI that serves user data. To protect your API from too many requests, you want to add rate limiting.

🎯 Goal: Create a FastAPI app that limits the number of requests a client can make within a time window.

📋 What You'll Learn

Create a FastAPI app instance named app

Define a dictionary called request_counts to track requests per client IP

Set a limit variable called MAX_REQUESTS to 5

Implement a dependency function rate_limiter that checks and updates request counts

Apply the rate_limiter dependency to a GET endpoint /data

Return a JSON response with {'message': 'Here is your data'} if under limit

Return a 429 HTTP error if the client exceeds the limit

💡 Why This Matters

🌍 Real World

APIs often need to protect themselves from too many requests that can overload servers or cause abuse. Rate limiting helps keep services stable and fair.

💼 Career

Backend developers frequently implement rate limiting to ensure APIs are reliable and secure under heavy traffic.

1

Create the FastAPI app and request tracking dictionary

Create a FastAPI app instance called app and a dictionary called request_counts to store the number of requests per client IP.

FastAPI

from fastapi import FastAPI

# Your code here

Hint

Use app = FastAPI() to create the app and request_counts = {} for the dictionary.

2

Set the maximum requests limit

Add a variable called MAX_REQUESTS and set it to 5 to limit the number of requests per client.

FastAPI

from fastapi import FastAPI

app = FastAPI()
request_counts = {}

# Your code here

Hint

Just create a variable MAX_REQUESTS and assign it the value 5.

3

Create the rate limiting dependency function

Write a function called rate_limiter that takes request from fastapi.Request. Inside, get the client IP from request.client.host. Increase the count in request_counts for that IP. If the count is greater than MAX_REQUESTS, raise fastapi.HTTPException with status code 429 and detail 'Too many requests'.

FastAPI

from fastapi import FastAPI

app = FastAPI()
request_counts = {}

MAX_REQUESTS = 5

# Your code here

Hint

Use request.client.host to get the IP and update request_counts. Raise HTTPException if over limit.

4

Add the GET endpoint with rate limiting

Create a GET endpoint /data using @app.get('/data'). Add the rate_limiter function as a dependency using Depends. The endpoint should return a dictionary {'message': 'Here is your data'}.

FastAPI

from fastapi import FastAPI, Request, HTTPException, Depends

app = FastAPI()
request_counts = {}

MAX_REQUESTS = 5

def rate_limiter(request: Request):
    client_ip = request.client.host
    count = request_counts.get(client_ip, 0) + 1
    request_counts[client_ip] = count
    if count > MAX_REQUESTS:
        raise HTTPException(status_code=429, detail='Too many requests')

# Your code here

Hint

Use @app.get('/data') and add Depends(rate_limiter) as a parameter to the endpoint function.

Practice

1.

What is the main purpose of rate limiting in a FastAPI application?

easy

A. To speed up database queries

B. To control how often users can call API endpoints

C. To add more routes automatically

D. To change the API response format

Solution

1. Step 1: Understand rate limiting concept

   Rate limiting restricts the number of requests a user can make in a time period.

2. Step 2: Identify the purpose in FastAPI

   It protects the app from overload and abuse by controlling request frequency.

3. Final Answer:

   To control how often users can call API endpoints -> Option B

4. Quick Check:

   Rate limiting = Control request frequency [OK]

Hint: Rate limiting means controlling request frequency [OK]

Common Mistakes:

• Thinking it speeds up queries
• Confusing with routing features
• Assuming it changes response format

2.

Which of the following is the correct way to import a rate limiter middleware in FastAPI?

from fastapi import FastAPI
from _____ import RateLimiterMiddleware

app = FastAPI()
app.add_middleware(RateLimiterMiddleware, max_requests=5, window_seconds=60)

easy

A. fastapi_utils

B. fastapi.middleware

C. fastapi_rate_limit

D. fastapi_limiter

Solution

1. Step 1: Recall FastAPI rate limiting libraries

   FastAPI commonly uses the external package 'fastapi_limiter' for rate limiting middleware.

2. Step 2: Match import statement

   The correct import is from 'fastapi_limiter' to get RateLimiterMiddleware.

3. Final Answer:

   fastapi_limiter -> Option D

4. Quick Check:

   RateLimiterMiddleware import = fastapi_limiter [OK]

Hint: Rate limiter middleware comes from fastapi_limiter package [OK]

Common Mistakes:

• Using built-in fastapi.middleware (no rate limiter there)
• Confusing with unrelated packages
• Misspelling package names

3.

Given this FastAPI code snippet using fastapi_limiter:

from fastapi import FastAPI
from fastapi_limiter import FastAPILimiter
from fastapi_limiter.depends import RateLimiter
import aioredis

app = FastAPI()

@app.on_event("startup")
async def startup():
    redis = await aioredis.from_url("redis://localhost")
    await FastAPILimiter.init(redis)

@app.get("/items", dependencies=[Depends(RateLimiter(times=3, seconds=10))])
async def read_items():
    return {"message": "Success"}

What happens if a user calls /items 4 times within 10 seconds?

medium

A. The server crashes due to Redis error

B. All 4 requests succeed with message 'Success'

C. The 4th request is blocked with a 429 Too Many Requests error

D. The 4th request is delayed but eventually succeeds

Solution

1. Step 1: Understand RateLimiter parameters

   RateLimiter(times=3, seconds=10) allows 3 requests every 10 seconds per user.

2. Step 2: Analyze 4 requests in 10 seconds

   The 4th request exceeds the limit and triggers a 429 error response.

3. Final Answer:

   The 4th request is blocked with a 429 Too Many Requests error -> Option C

4. Quick Check:

   Requests > limit = 429 error [OK]

Hint: Requests over limit cause 429 error response [OK]

Common Mistakes:

• Assuming all requests succeed
• Thinking server crashes on limit
• Believing requests get delayed instead of blocked

4.

Identify the error in this FastAPI rate limiting setup:

from fastapi import FastAPI
from fastapi_limiter import FastAPILimiter
import aioredis

app = FastAPI()

@app.on_event("startup")
async def startup():
    redis = aioredis.from_url("redis://localhost")
    await FastAPILimiter.init(redis)

@app.get("/data", dependencies=[Depends(RateLimiter(times=2, seconds=5))])
async def get_data():
    return {"data": "info"}

medium

A. Missing await before aioredis.from_url call

B. RateLimiter times parameter must be 5 or more

C. FastAPILimiter.init should not be awaited

D. Redis URL must use http:// instead of redis://

Solution

1. Step 1: Check aioredis.from_url usage

   aioredis.from_url is an async function and must be awaited to get the Redis client.

2. Step 2: Identify missing await

   The code calls aioredis.from_url without await, causing a coroutine object instead of Redis client.

3. Final Answer:

   Missing await before aioredis.from_url call -> Option A

4. Quick Check:

   Async calls need await [OK]

Hint: Always await async Redis client creation [OK]

Common Mistakes:

• Forgetting await on async functions
• Misunderstanding RateLimiter parameters
• Using wrong Redis URL scheme

5.

You want to limit users to 10 requests per minute globally across multiple FastAPI instances behind a load balancer. Which setup is best?

1. Use in-memory counters in each instance
2. Use Redis with fastapi_limiter shared by all instances
3. Use local file storage for counts
4. Disable rate limiting

hard

A. Option 2: Use Redis with fastapi_limiter shared by all instances

B. Option 1: Use in-memory counters in each instance

C. Option 3: Use local file storage for counts

D. Option 4: Disable rate limiting

Solution

1. Step 1: Understand distributed rate limiting need

   Multiple FastAPI instances require a shared store to track request counts globally.

2. Step 2: Evaluate options

   In-memory counters are local to each instance, causing inconsistent limits. Local files are not suitable for concurrency. Disabling rate limiting removes protection.

3. Step 3: Choose Redis shared by all instances

   Redis is a fast, centralized store that all instances can use to enforce limits consistently.

4. Final Answer:

   Option 2: Use Redis with fastapi_limiter shared by all instances -> Option A

5. Quick Check:

   Distributed rate limiting needs shared Redis [OK]

Hint: Use shared Redis for consistent limits across instances [OK]

Common Mistakes:

• Using local memory causing inconsistent limits
• Using file storage which is slow and unsafe
• Disabling rate limiting ignoring abuse risks