Rate limiting for protection in Flask - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the Flask-Limiter extension.

Flask

from flask_limiter import [1]

Drag options to blanks, or click blank then click option'

ALimiter

BRateLimiter

CLimiterExtension

DFlaskLimiter

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect class names like RateLimiter or FlaskLimiter.

Trying to import from wrong modules.

The Flask-Limiter extension is imported using Limiter.

2fill in blank

medium

Complete the code to create a Limiter instance with default limits.

Flask

limiter = Limiter(app, default_limits=["[1] per minute"])

Drag options to blanks, or click blank then click option'

A10

B5

C100

D50

Attempts:

3 left

💡 Hint

Common Mistakes

Using too high a limit like 100 which is less protective.

Using invalid strings without 'per minute'.

The example uses a default limit of 5 per minute to protect the app.

3fill in blank

hard

Fix the error in the decorator to apply rate limiting on the route.

Flask

@limiter.[1]("3 per minute")
def home():
    return "Welcome!"

Drag options to blanks, or click blank then click option'

Alimit_rate

Brate_limit

Climit

Dlimiter

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect decorator names like rate_limit or limiter.

Misspelling the method name.

The correct decorator method is limit to set rate limits on routes.

4fill in blank

hard

Fill both blanks to create a rate limit key function using IP address.

Flask

def [2]():
    return request.[1]

limiter = Limiter(app, key_func=[2])

Drag options to blanks, or click blank then click option'

Aremote_addr

Bip_address

Cclient_ip

Duser_ip

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect attribute names like ip_address or client_ip.

Passing wrong function names to key_func.

The IP address is accessed via request.remote_addr, and the key function is set to remote_addr.

5fill in blank

hard

Fill all three blanks to create a custom error message for rate limit exceeded.

Flask

from flask import Flask, jsonify

@limiter.[1]("2 per minute")
def limited_route():
    return jsonify({"message": "[2]"}), [3]

Drag options to blanks, or click blank then click option'

Alimit

BToo many requests, slow down!

C429

Drate_limit

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong decorator names like rate_limit.

Using incorrect status codes like 400 or 500.

Not providing a clear error message.

The decorator is limit, the message informs the user, and HTTP status code 429 means too many requests.

Practice

1. What is the main purpose of rate limiting in a Flask application?

easy

A. To control how many requests a user can make in a given time period

B. To speed up the database queries

C. To change the user interface dynamically

D. To encrypt user data automatically

Solution

1. Step 1: Understand rate limiting concept

   Rate limiting restricts the number of requests a user can send to prevent overload.

2. Step 2: Identify the purpose in Flask apps

   It protects the app from abuse and excessive traffic by limiting requests.

3. Final Answer:

   To control how many requests a user can make in a given time period -> Option A

4. Quick Check:

   Rate limiting = request control [OK]

Hint: Rate limiting limits requests per time to protect apps [OK]

Common Mistakes:

• Confusing rate limiting with database optimization
• Thinking it changes UI behavior
• Assuming it encrypts data automatically

2. Which of the following is the correct way to initialize Flask-Limiter in a Flask app?

easy

A. limiter = Limiter(app)

B. limiter = Limiter(key_func=get_remote_address)

C. limiter = Limiter(app, key_func=get_remote_address)

D. limiter = Limiter()

Solution

1. Step 1: Check Flask-Limiter initialization syntax

   Flask-Limiter requires the Flask app instance and a key function to identify clients.

2. Step 2: Identify correct parameters

   Passing both app and key_func=get_remote_address is necessary for proper setup.

3. Final Answer:

   limiter = Limiter(app, key_func=get_remote_address) -> Option C

4. Quick Check:

   Limiter init requires app and key_func [OK]

Hint: Always pass app and key_func when creating Limiter [OK]

Common Mistakes:

• Omitting the app parameter
• Not specifying key_func
• Calling Limiter without arguments

3. Given this Flask route with rate limiting:

@app.route('/api')
@limiter.limit('2 per minute')
def api():
    return 'OK'

What happens if a user sends 3 requests within one minute?

medium

A. The third request returns 'OK' as usual

B. The third request is blocked with a 429 Too Many Requests error

C. All requests are blocked

D. The server crashes

Solution

1. Step 1: Understand the rate limit decorator

   The decorator limits requests to 2 per minute per user.

2. Step 2: Analyze the third request behavior

   The third request exceeds the limit and triggers a 429 error response.

3. Final Answer:

   The third request is blocked with a 429 Too Many Requests error -> Option B

4. Quick Check:

   Exceeding limit = 429 error [OK]

Hint: Requests over limit get 429 error response [OK]

Common Mistakes:

• Assuming all requests succeed
• Thinking server crashes on limit
• Believing all requests get blocked

4. You wrote this code but rate limiting is not working:

limiter = Limiter()

@app.route('/test')
@limiter.limit('5 per minute')
def test():
    return 'Test'

What is the likely problem?

medium

A. The limit string format is incorrect

B. The function name is invalid

C. The route decorator is missing

D. Limiter was not given the Flask app instance

Solution

1. Step 1: Check Limiter initialization

   Limiter must be initialized with the Flask app instance to work.

2. Step 2: Identify missing app parameter

   Here, Limiter() is called without app, so rate limiting won't activate.

3. Final Answer:

   Limiter was not given the Flask app instance -> Option D

4. Quick Check:

   Missing app in Limiter = no limit [OK]

Hint: Always pass app to Limiter for it to work [OK]

Common Mistakes:

• Ignoring the need to pass app to Limiter
• Thinking limit string format causes failure
• Assuming route decorator is missing

5. You want to apply different rate limits for logged-in users and guests in Flask using Flask-Limiter. Which approach correctly implements this?

hard

A. Use a custom key_func that returns user ID if logged in, else IP address

B. Apply the same limit to all users without distinction

C. Set limit only on the route without key_func customization

D. Disable rate limiting for logged-in users completely

Solution

1. Step 1: Understand user identification for rate limiting

   To differentiate limits, key_func must identify users uniquely.

2. Step 2: Use custom key_func logic

   Return user ID for logged-in users, IP for guests to apply different limits.

3. Final Answer:

   Use a custom key_func that returns user ID if logged in, else IP address -> Option A

4. Quick Check:

   Custom key_func distinguishes users [OK]

Hint: Custom key_func distinguishes users for different limits [OK]

Common Mistakes:

• Applying same limit to all users ignoring login status
• Not customizing key_func for user identity
• Disabling limits for logged-in users without reason