Rate limiting for protection in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

Understanding basic rate limiting behavior in Flask

Given this Flask app snippet using Flask-Limiter, what happens when a client exceeds the limit?

Flask

from flask import Flask
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

app = Flask(__name__)
limiter = Limiter(app, key_func=get_remote_address, default_limits=["3 per minute"])

@app.route("/")
def index():
    return "Hello, world!"

A The client is blocked permanently after 3 requests.

B The client receives a 429 Too Many Requests error after 3 requests in one minute.

C The client receives a 500 Internal Server Error after 3 requests.

D The client can make unlimited requests without any error.

💡 Hint

Think about what '3 per minute' means for request limits.

The Flask-Limiter is set to allow 3 requests per minute per client IP. After the third request, the client gets a 429 error until the minute resets.

📝 Syntax

intermediate

Identify the syntax error in Flask-Limiter setup

Which option contains a syntax error in setting up Flask-Limiter with a custom limit?

Flask

from flask import Flask
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

app = Flask(__name__)
limiter = Limiter(app, key_func=get_remote_address, default_limits=["5 per minute"])

@app.route("/data")
@limiter.limit("10 per minute")
def data():
    return "Data response"

A

@limiter.limit(10 per minute)
def data():
    return "Data response"

B

@limiter.limit('10 per minute')
def data():
    return "Data response"

C

@limiter.limit("10 per minute")
def data():
    return "Data response"

D

@limiter.limit("10/minute")
def data():
    return "Data response"

💡 Hint

Check how the limit string is passed in the decorator.

The limit must be a string. Option A misses quotes, causing a syntax error.

🔧 Debug

advanced

Why does the rate limit not apply as expected?

A developer uses Flask-Limiter with this code but finds the limit is never enforced. What is the cause?

Flask

from flask import Flask
from flask_limiter import Limiter

app = Flask(__name__)
limiter = Limiter(key_func=lambda: "fixed_key")

@app.route("/test")
@limiter.limit("2 per minute")
def test():
    return "Test endpoint"

A The Limiter is not attached to the Flask app instance, so limits are not enforced.

B The key_func returns a fixed string, so all clients share the same limit, causing no limit.

C The route decorator is missing, so the function is never called.

D The limit string "2 per minute" is invalid and ignored.

💡 Hint

Check how Limiter is initialized with the app.

The Limiter instance is created without passing the Flask app, so it is not linked and does not enforce limits.

❓ state_output

advanced

What is the value of remaining requests after 2 calls?

Using Flask-Limiter with a limit of 3 requests per minute, what is the remaining request count after two successful calls from the same client?

Flask

from flask import Flask
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

app = Flask(__name__)
limiter = Limiter(app, key_func=get_remote_address, default_limits=["3 per minute"])

@app.route("/resource")
def resource():
    return "Resource accessed"

A 2

B 0

C 1

D 3

💡 Hint

Think about how many requests remain after two out of three allowed.

With a limit of 3 per minute, after 2 requests, 1 request remains before hitting the limit.

🧠 Conceptual

expert

Why use a distributed rate limiter in Flask apps?

In a Flask app deployed on multiple servers behind a load balancer, why is using a distributed rate limiter important?

A Because distributed rate limiters automatically block all IP addresses permanently.

B Because distributed rate limiters are faster than local ones in single-server setups.

C Because Flask does not support local rate limiting without a distributed system.

D Because local in-memory limits on each server won't share state, allowing clients to bypass limits by switching servers.

💡 Hint

Consider what happens when requests come to different servers.

Local limits only track requests per server. Clients can avoid limits by hitting different servers. Distributed limiters share state across servers to enforce limits globally.