Rate limiting in FastAPI - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the rate limiting dependency from fastapi-limiter.

FastAPI

from fastapi_limiter import [1]

Drag options to blanks, or click blank then click option'

ARateLimiter

BLimiterDependency

CLimiter

DRateLimit

Attempts:

3 left

💡 Hint

Common Mistakes

Importing a non-existent class like 'Limiter' or 'RateLimit'.

Confusing the import with other unrelated classes.

The RateLimiter is the correct class to import for rate limiting in FastAPI using fastapi-limiter.

2fill in blank

medium

Complete the code to apply a rate limit of 5 requests per minute to the endpoint.

FastAPI

@app.get("/items", dependencies=[Depends([1]("5/minute"))])
def read_items():
    return {"message": "Hello"}

Drag options to blanks, or click blank then click option'

ALimiterDependency

BLimiter

CRateLimiter

DDepends

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'Depends' directly instead of wrapping the rate limiter.

Using incorrect class names like 'Limiter'.

The RateLimiter dependency is used to enforce the rate limit on the endpoint.

3fill in blank

hard

Fix the error in the initialization of the Redis backend for rate limiting.

FastAPI

import aioredis

redis = aioredis.from_url([1])

@app.on_event("startup")
async def startup():
    await FastAPILimiter.init(redis)

Drag options to blanks, or click blank then click option'

A"redis://localhost:6379"

B"http://localhost:6379"

C"localhost:6379"

D"redis://127.0.0.1"

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'http://' instead of 'redis://'.

Omitting the port number.

Using just the hostname without protocol.

The Redis URL must start with redis:// and include the port number for proper connection.

4fill in blank

hard

Fill both blanks to create a rate limit that allows 10 requests per minute and 100 requests per hour.

FastAPI

@app.get("/data", dependencies=[Depends(RateLimiter([1])), Depends(RateLimiter([2]))])
async def get_data():
    return {"data": "sample"}

Drag options to blanks, or click blank then click option'

A"10/minute"

B"100/hour"

C"10/hour"

D"100/minute"

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up 'minute' and 'hour' in the strings.

Using incorrect numbers or units.

The first rate limiter allows 10 requests per minute, and the second allows 100 requests per hour, combining limits.

5fill in blank

hard

Fill all three blanks to create a dictionary comprehension that maps each user to their request count if it is greater than 10.

FastAPI

user_counts = {user: count for user, count in counts.items() if count [1] [2] and user.is_active == [3]

Drag options to blanks, or click blank then click option'

A>

B10

CTrue

D<

Attempts:

3 left

💡 Hint

Common Mistakes

Using '<' instead of '>' for count comparison.

Checking user.is_active against a string instead of boolean.

This comprehension filters users with counts greater than 10 and only active users.

Practice

1.

What is the main purpose of rate limiting in a FastAPI application?

easy

A. To speed up database queries

B. To control how often users can call API endpoints

C. To add more routes automatically

D. To change the API response format

Solution

1. Step 1: Understand rate limiting concept

   Rate limiting restricts the number of requests a user can make in a time period.

2. Step 2: Identify the purpose in FastAPI

   It protects the app from overload and abuse by controlling request frequency.

3. Final Answer:

   To control how often users can call API endpoints -> Option B

4. Quick Check:

   Rate limiting = Control request frequency [OK]

Hint: Rate limiting means controlling request frequency [OK]

Common Mistakes:

• Thinking it speeds up queries
• Confusing with routing features
• Assuming it changes response format

2.

Which of the following is the correct way to import a rate limiter middleware in FastAPI?

from fastapi import FastAPI
from _____ import RateLimiterMiddleware

app = FastAPI()
app.add_middleware(RateLimiterMiddleware, max_requests=5, window_seconds=60)

easy

A. fastapi_utils

B. fastapi.middleware

C. fastapi_rate_limit

D. fastapi_limiter

Solution

1. Step 1: Recall FastAPI rate limiting libraries

   FastAPI commonly uses the external package 'fastapi_limiter' for rate limiting middleware.

2. Step 2: Match import statement

   The correct import is from 'fastapi_limiter' to get RateLimiterMiddleware.

3. Final Answer:

   fastapi_limiter -> Option D

4. Quick Check:

   RateLimiterMiddleware import = fastapi_limiter [OK]

Hint: Rate limiter middleware comes from fastapi_limiter package [OK]

Common Mistakes:

• Using built-in fastapi.middleware (no rate limiter there)
• Confusing with unrelated packages
• Misspelling package names

3.

Given this FastAPI code snippet using fastapi_limiter:

from fastapi import FastAPI
from fastapi_limiter import FastAPILimiter
from fastapi_limiter.depends import RateLimiter
import aioredis

app = FastAPI()

@app.on_event("startup")
async def startup():
    redis = await aioredis.from_url("redis://localhost")
    await FastAPILimiter.init(redis)

@app.get("/items", dependencies=[Depends(RateLimiter(times=3, seconds=10))])
async def read_items():
    return {"message": "Success"}

What happens if a user calls /items 4 times within 10 seconds?

medium

A. The server crashes due to Redis error

B. All 4 requests succeed with message 'Success'

C. The 4th request is blocked with a 429 Too Many Requests error

D. The 4th request is delayed but eventually succeeds

Solution

1. Step 1: Understand RateLimiter parameters

   RateLimiter(times=3, seconds=10) allows 3 requests every 10 seconds per user.

2. Step 2: Analyze 4 requests in 10 seconds

   The 4th request exceeds the limit and triggers a 429 error response.

3. Final Answer:

   The 4th request is blocked with a 429 Too Many Requests error -> Option C

4. Quick Check:

   Requests > limit = 429 error [OK]

Hint: Requests over limit cause 429 error response [OK]

Common Mistakes:

• Assuming all requests succeed
• Thinking server crashes on limit
• Believing requests get delayed instead of blocked

4.

Identify the error in this FastAPI rate limiting setup:

from fastapi import FastAPI
from fastapi_limiter import FastAPILimiter
import aioredis

app = FastAPI()

@app.on_event("startup")
async def startup():
    redis = aioredis.from_url("redis://localhost")
    await FastAPILimiter.init(redis)

@app.get("/data", dependencies=[Depends(RateLimiter(times=2, seconds=5))])
async def get_data():
    return {"data": "info"}

medium

A. Missing await before aioredis.from_url call

B. RateLimiter times parameter must be 5 or more

C. FastAPILimiter.init should not be awaited

D. Redis URL must use http:// instead of redis://

Solution

1. Step 1: Check aioredis.from_url usage

   aioredis.from_url is an async function and must be awaited to get the Redis client.

2. Step 2: Identify missing await

   The code calls aioredis.from_url without await, causing a coroutine object instead of Redis client.

3. Final Answer:

   Missing await before aioredis.from_url call -> Option A

4. Quick Check:

   Async calls need await [OK]

Hint: Always await async Redis client creation [OK]

Common Mistakes:

• Forgetting await on async functions
• Misunderstanding RateLimiter parameters
• Using wrong Redis URL scheme

5.

You want to limit users to 10 requests per minute globally across multiple FastAPI instances behind a load balancer. Which setup is best?

1. Use in-memory counters in each instance
2. Use Redis with fastapi_limiter shared by all instances
3. Use local file storage for counts
4. Disable rate limiting

hard

A. Option 2: Use Redis with fastapi_limiter shared by all instances

B. Option 1: Use in-memory counters in each instance

C. Option 3: Use local file storage for counts

D. Option 4: Disable rate limiting

Solution

1. Step 1: Understand distributed rate limiting need

   Multiple FastAPI instances require a shared store to track request counts globally.

2. Step 2: Evaluate options

   In-memory counters are local to each instance, causing inconsistent limits. Local files are not suitable for concurrency. Disabling rate limiting removes protection.

3. Step 3: Choose Redis shared by all instances

   Redis is a fast, centralized store that all instances can use to enforce limits consistently.

4. Final Answer:

   Option 2: Use Redis with fastapi_limiter shared by all instances -> Option A

5. Quick Check:

   Distributed rate limiting needs shared Redis [OK]

Hint: Use shared Redis for consistent limits across instances [OK]

Common Mistakes:

• Using local memory causing inconsistent limits
• Using file storage which is slow and unsafe
• Disabling rate limiting ignoring abuse risks