Flask-Limiter for rate limiting - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Flask-Limiter used for in a Flask application?

Flask-Limiter is used to control how many times a user or client can access certain routes in a Flask app within a set time. It helps prevent too many requests, protecting the app from overload or abuse.

beginner

How do you apply a simple rate limit of 5 requests per minute to a Flask route using Flask-Limiter?

You decorate the route with @limiter.limit('5 per minute'). This tells Flask-Limiter to allow only 5 requests to that route every minute from the same client.

intermediate

What is the default key used by Flask-Limiter to identify clients for rate limiting?

By default, Flask-Limiter uses the client's IP address to track and limit requests.

advanced

How can you customize the key function in Flask-Limiter to use user ID instead of IP address?

You can pass a custom key function to Flask-Limiter that returns the user ID from the request context, so limits apply per user rather than per IP.

beginner

What happens when a client exceeds the rate limit set by Flask-Limiter?

Flask-Limiter returns a 429 Too Many Requests HTTP response, telling the client to slow down and try again later.

Which decorator applies a rate limit of 10 requests per hour to a Flask route?

A @limiter.rate('10/hour')

B @limiter.limit('hourly 10')

C @limiter.limit('10 per hour')

D @limit('10 requests per hour')

The correct syntax is @limiter.limit('10 per hour'). Other options are invalid.

What default client identifier does Flask-Limiter use to track request counts?

A Client IP address

B User agent string

C Session cookie

D Request URL

Flask-Limiter uses the client's IP address by default to identify and limit requests.

What HTTP status code does Flask-Limiter return when a client exceeds the rate limit?

A 429 Too Many Requests

B 404 Not Found

C 403 Forbidden

D 500 Internal Server Error

429 Too Many Requests is the standard response when rate limits are exceeded.

How can you apply different rate limits to different routes in Flask-Limiter?

A Use different Flask apps for each route

B Set global limit once for all routes

C Change the IP address for each route

D Use @limiter.limit decorator with different limits on each route

You apply @limiter.limit with specific limits on each route to customize rate limits.

Which of these is NOT a valid rate limit string for Flask-Limiter?

A '100 per day'

B '10 requests per minute'

C '20/hour'

D '5 per second'

'10 requests per minute' is invalid because the word 'requests' should not be included in the string.

Explain how Flask-Limiter helps protect a Flask app and how you set a basic rate limit on a route.

Think about stopping too many requests from one user.

Describe how Flask-Limiter identifies clients by default and how you might change this behavior.

Consider what makes each user unique.