Flask-Limiter for rate limiting - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a client exceeds the rate limit in Flask-Limiter?

Consider a Flask app using Flask-Limiter with a limit of 5 requests per minute per IP. What is the default behavior when a client sends the 6th request within the same minute?

Flask

from flask import Flask
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

app = Flask(__name__)
limiter = Limiter(app, key_func=get_remote_address, default_limits=["5 per minute"])

@app.route('/')
def index():
    return "Hello, world!"

A The server returns a 429 Too Many Requests error response.

B The server queues the request and processes it after the minute passes.

C The server ignores the limit and processes the request normally.

D The server restarts the Flask app to reset the limit.

💡 Hint

Think about HTTP status codes related to rate limiting.

Flask-Limiter returns a 429 status code when the client exceeds the allowed number of requests in the given time window.

📝 Syntax

intermediate

Which code snippet correctly applies a custom rate limit to a single Flask route?

You want to limit the route /api/data to 10 requests per hour per user IP. Which code snippet correctly applies this limit using Flask-Limiter?

A

@app.route('/api/data')
@limiter.limit('10/hour')
def data():
    return 'Data here'

B

@app.route('/api/data')
@limiter.limit(10, 'hour')
def data():
    return 'Data here'

C

@app.route('/api/data')
@limiter.limit('10 per hour')
def data():
    return 'Data here'

D

@app.route('/api/data')
@limiter.limit('hour:10')
def data():
    return 'Data here'

💡 Hint

Check the string format for rate limits in Flask-Limiter.

The correct format is a string like '10 per hour'. Other formats cause errors or are invalid.

🔧 Debug

advanced

Why does this Flask-Limiter setup not enforce any limits?

Review the code below. Why does the rate limit not work as expected?

Flask

from flask import Flask
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

app = Flask(__name__)
limiter = Limiter(key_func=get_remote_address)

@app.route('/')
def home():
    return 'Welcome!'

@app.route('/test')
@limiter.limit('3 per minute')
def test():
    return 'Test route'

A No default_limits are set in Limiter, so only routes with explicit limits are limited.

B The key_func is missing, so Flask-Limiter cannot identify clients.

C The Flask app is missing a secret key, so Flask-Limiter cannot store limits.

D The @limiter.limit decorator is applied after the route decorator, causing it to be ignored.

💡 Hint

Think about how Flask-Limiter applies limits globally vs per route.

Without default_limits, only routes decorated with @limiter.limit have limits. The '/' route has no limit, so it is unlimited.

❓ state_output

advanced

What is the value of the remaining requests after 2 calls to a limited route?

Given this Flask route limited to 5 requests per minute, what is the remaining number of allowed requests after calling it twice from the same IP?

Flask

from flask import Flask, jsonify
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

app = Flask(__name__)
limiter = Limiter(app, key_func=get_remote_address, default_limits=["5 per minute"])

@app.route('/limited')
@limiter.limit('5 per minute')
def limited():
    remaining = limiter.current_limit.remaining
    return jsonify({'remaining': remaining})

A 0

B 5

C 2

D 3

💡 Hint

Remember the limit is 5 requests per minute total.

After 2 requests, 3 requests remain before hitting the limit of 5.

🧠 Conceptual

expert

Which key function best supports user-based rate limiting in Flask-Limiter?

You want to limit requests per authenticated user, not per IP. Which key function should you use with Flask-Limiter?

A get_remote_address from flask_limiter.util to get the client IP address.

B A function that returns the current user's unique ID from the session or token.

C A function that returns a constant string for all users.

D A function that returns the Flask app's secret key.

💡 Hint

Think about how to identify users uniquely beyond IP.

To limit by user, the key function must return a unique identifier per user, such as user ID from session or token.

Practice

1. What is the main purpose of using Flask-Limiter in a Flask application?

easy

A. To limit how many requests a user can make in a given time

B. To speed up the Flask application by caching responses

C. To automatically generate API documentation

D. To handle database migrations smoothly

Solution

1. Step 1: Understand Flask-Limiter's role

   Flask-Limiter is designed to control the number of requests a user can make to prevent abuse.

2. Step 2: Compare options with Flask-Limiter's purpose

   Options A, B, and D relate to documentation, caching, and migrations, which are unrelated to rate limiting.

3. Final Answer:

   To limit how many requests a user can make in a given time -> Option A

4. Quick Check:

   Flask-Limiter = request limiting [OK]

Hint: Flask-Limiter controls request frequency to protect your app [OK]

Common Mistakes:

• Confusing Flask-Limiter with caching tools
• Thinking it manages database or docs
• Assuming it speeds up the app

2. Which of the following is the correct way to apply a rate limit of 5 requests per minute to a Flask route using Flask-Limiter?

easy

A. @limiter.limit('minute/5')\ndef my_route():\n return 'Hello'

B. @limiter.limit(5)\ndef my_route():\n return 'Hello'

C. @limiter.limit('5 requests')\ndef my_route():\n return 'Hello'

D. @limiter.limit('5/minute')\ndef my_route():\n return 'Hello'

Solution

1. Step 1: Check the syntax for rate limit string

   The correct format is a string like '5/minute' specifying count and time unit.

2. Step 2: Validate each option's syntax

   @limiter.limit('5/minute')\ndef my_route():\n return 'Hello' uses '5/minute' which is correct. Options B, C, and D use incorrect formats or missing quotes.

3. Final Answer:

   @limiter.limit('5/minute')\ndef my_route():\n return 'Hello' -> Option D

4. Quick Check:

   Correct limit string format = @limiter.limit('5/minute')\ndef my_route():\n return 'Hello' [OK]

Hint: Use string 'count/unit' like '5/minute' in @limiter.limit [OK]

Common Mistakes:

• Omitting quotes around the limit string
• Using numbers without units
• Incorrect time unit format

3. Given this Flask app snippet using Flask-Limiter:

from flask import Flask
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

app = Flask(__name__)
limiter = Limiter(app, key_func=get_remote_address)

@app.route('/')
@limiter.limit('2/minute')
def home():
    return 'Welcome!'

# Assume the same client makes 3 quick requests

What will happen on the third request from the same client within one minute?

medium

A. The third request will be blocked with a 429 Too Many Requests error

B. The third request will succeed and return 'Welcome!'

C. The app will crash with an exception

D. The third request will be delayed but eventually succeed

Solution

1. Step 1: Understand the limit set

   The route is limited to 2 requests per minute per client IP.

2. Step 2: Analyze the third request behavior

   The third request exceeds the limit, so Flask-Limiter blocks it with a 429 error.

3. Final Answer:

   The third request will be blocked with a 429 Too Many Requests error -> Option A

4. Quick Check:

   Requests > limit = 429 error [OK]

Hint: Requests over limit get 429 error response [OK]

Common Mistakes:

• Thinking extra requests succeed silently
• Assuming app crashes on limit exceed
• Believing requests get delayed instead of blocked

4. Consider this Flask app code snippet using Flask-Limiter:

from flask import Flask
from flask_limiter import Limiter

app = Flask(__name__)
limiter = Limiter(app)

@app.route('/test')
@limiter.limit('3/minute')
def test():
    return 'Test'

When running this code, the rate limiting does not work as expected. What is the most likely cause?

medium

A. The limit string '3/minute' is invalid syntax

B. The decorator @limiter.limit must be placed before @app.route

C. Missing key_func argument to identify clients, so all requests share the same limit

D. Flask-Limiter requires Flask app to be created after Limiter

Solution

1. Step 1: Check Limiter initialization

   Limiter is created without a key_func, so it uses default which may not distinguish clients properly.

2. Step 2: Understand key_func role

   Without key_func like get_remote_address, all requests share the same limit, causing unexpected behavior.

3. Final Answer:

   Missing key_func argument to identify clients, so all requests share the same limit -> Option C

4. Quick Check:

   key_func missing = shared limit problem [OK]

Hint: Always set key_func to identify clients for correct limits [OK]

Common Mistakes:

• Assuming limit string syntax is wrong
• Thinking decorator order matters here
• Believing app creation order affects Limiter

5. You want to apply a global rate limit of 10 requests per minute for all routes but allow a specific route /special to have a higher limit of 30 requests per minute using Flask-Limiter. Which code snippet correctly implements this?

hard

A. limiter = Limiter(app)

@app.route('/special')
@limiter.limit('30/minute')
def special():
return 'Special access'

@app.route('/')
def home():
return 'Home'

B. limiter = Limiter(app, key_func=get_remote_address, default_limits=['10/minute'])

@app.route('/special')
@limiter.limit('30/minute')
def special():
return 'Special access'

C. limiter = Limiter(app, key_func=get_remote_address, default_limits=['30/minute'])

@app.route('/special')
@limiter.limit('10/minute')
def special():
return 'Special access'

D. limiter = Limiter(app, key_func=get_remote_address)

@app.route('/special')
@limiter.limit('10/minute')
def special():
return 'Special access'

limiter.default_limits = ['30/minute']

Solution

1. Step 1: Set global default limits

   Use default_limits=['10/minute'] in Limiter to apply global rate limits.

2. Step 2: Override limit on specific route

   Use @limiter.limit('30/minute') decorator on /special route to allow higher limit.

3. Final Answer:

   limiter = Limiter(app, key_func=get_remote_address, default_limits=['10/minute']) @app.route('/special') @limiter.limit('30/minute') def special(): return 'Special access' -> Option B

4. Quick Check:

   Global default + route override = limiter = Limiter(app, key_func=get_remote_address, default_limits=['10/minute']) @app.route('/special') @limiter.limit('30/minute') def special(): return 'Special access' [OK]

Hint: Set default_limits globally, override with @limiter.limit per route [OK]

Common Mistakes:

• Confusing default_limits with per-route limits
• Not setting key_func for client identification
• Trying to change default_limits after initialization