Flask-Limiter for rate limiting - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a client exceeds the rate limit in Flask-Limiter?

Consider a Flask app using Flask-Limiter with a limit of 5 requests per minute per IP. What is the default behavior when a client sends the 6th request within the same minute?

Flask

from flask import Flask
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

app = Flask(__name__)
limiter = Limiter(app, key_func=get_remote_address, default_limits=["5 per minute"])

@app.route('/')
def index():
    return "Hello, world!"

A The server returns a 429 Too Many Requests error response.

B The server queues the request and processes it after the minute passes.

C The server ignores the limit and processes the request normally.

D The server restarts the Flask app to reset the limit.

💡 Hint

Think about HTTP status codes related to rate limiting.

Flask-Limiter returns a 429 status code when the client exceeds the allowed number of requests in the given time window.

📝 Syntax

intermediate

Which code snippet correctly applies a custom rate limit to a single Flask route?

You want to limit the route /api/data to 10 requests per hour per user IP. Which code snippet correctly applies this limit using Flask-Limiter?

A

@app.route('/api/data')
@limiter.limit('10/hour')
def data():
    return 'Data here'

B

@app.route('/api/data')
@limiter.limit(10, 'hour')
def data():
    return 'Data here'

C

@app.route('/api/data')
@limiter.limit('10 per hour')
def data():
    return 'Data here'

D

@app.route('/api/data')
@limiter.limit('hour:10')
def data():
    return 'Data here'

💡 Hint

Check the string format for rate limits in Flask-Limiter.

The correct format is a string like '10 per hour'. Other formats cause errors or are invalid.

🔧 Debug

advanced

Why does this Flask-Limiter setup not enforce any limits?

Review the code below. Why does the rate limit not work as expected?

Flask

from flask import Flask
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

app = Flask(__name__)
limiter = Limiter(key_func=get_remote_address)

@app.route('/')
def home():
    return 'Welcome!'

@app.route('/test')
@limiter.limit('3 per minute')
def test():
    return 'Test route'

A No default_limits are set in Limiter, so only routes with explicit limits are limited.

B The key_func is missing, so Flask-Limiter cannot identify clients.

C The Flask app is missing a secret key, so Flask-Limiter cannot store limits.

D The @limiter.limit decorator is applied after the route decorator, causing it to be ignored.

💡 Hint

Think about how Flask-Limiter applies limits globally vs per route.

Without default_limits, only routes decorated with @limiter.limit have limits. The '/' route has no limit, so it is unlimited.

❓ state_output

advanced

What is the value of the remaining requests after 2 calls to a limited route?

Given this Flask route limited to 5 requests per minute, what is the remaining number of allowed requests after calling it twice from the same IP?

Flask

from flask import Flask, jsonify
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

app = Flask(__name__)
limiter = Limiter(app, key_func=get_remote_address, default_limits=["5 per minute"])

@app.route('/limited')
@limiter.limit('5 per minute')
def limited():
    remaining = limiter.current_limit.remaining
    return jsonify({'remaining': remaining})

A 0

B 5

C 2

D 3

💡 Hint

Remember the limit is 5 requests per minute total.

After 2 requests, 3 requests remain before hitting the limit of 5.

🧠 Conceptual

expert

Which key function best supports user-based rate limiting in Flask-Limiter?

You want to limit requests per authenticated user, not per IP. Which key function should you use with Flask-Limiter?

A get_remote_address from flask_limiter.util to get the client IP address.

B A function that returns the current user's unique ID from the session or token.

C A function that returns a constant string for all users.

D A function that returns the Flask app's secret key.

💡 Hint

Think about how to identify users uniquely beyond IP.

To limit by user, the key function must return a unique identifier per user, such as user ID from session or token.