Rate limiting for protection in Flask - Step-by-Step Execution

Concept Flow - Rate limiting for protection

Client sends request

↓

Check request count for client

↓

Is count < limit?

No→Reject request with error

Yes↓

Process request

↓

Increment request count

↓

Send response

↓

Wait for time window reset

↓

Reset request count

This flow shows how a server checks the number of requests from a client, allows or blocks requests based on a limit, and resets counts after a time window.

Execution Sample

Flask

from flask import Flask, request, jsonify
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

app = Flask(__name__)
limiter = Limiter(app, key_func=get_remote_address, default_limits=["3 per minute"])

@app.route("/data")
@limiter.limit("3 per minute")
def data():
    return jsonify({"message": "Success"})

This Flask app limits each client IP to 3 requests per minute on the /data route.

Execution Table

Step	Client IP	Request Count	Condition (count < 3?)	Action	Response
1	192.168.1.10	0	Yes	Process request	200 Success
2	192.168.1.10	1	Yes	Process request	200 Success
3	192.168.1.10	2	Yes	Process request	200 Success
4	192.168.1.10	3	No	Reject request	429 Too Many Requests
5	192.168.1.10	3	No	Reject request	429 Too Many Requests
6	192.168.1.10	Reset after 1 minute	Yes	Process request	200 Success

💡 Request count reaches limit 3, further requests are blocked until reset after 1 minute.

Variable Tracker

Variable	Start	After 1	After 2	After 3	After 4	After reset
request_count	0	1	2	3	3	0

Key Moments - 2 Insights

Why does the 4th request get rejected even though the client is still sending requests?

Because the request count reached the limit of 3 (see execution_table step 4), the server blocks further requests until the time window resets.

What happens to the request count after one minute?

The request count resets to 0 (see variable_tracker After reset), allowing the client to send requests again.

Visual Quiz - 3 Questions

Look at the execution table, what is the request count at step 3?

A 3

B 2

C 1

D 0

💡 Hint

Check the 'Request Count' column at step 3 in the execution_table.

At which step does the server start rejecting requests?

A Step 4

B Step 2

C Step 3

D Step 5

💡 Hint

Look for 'Reject request' action in the execution_table.

If the limit was changed to 5 requests per minute, how would the request count at step 4 change?

A It would be 3

B It would be 5

C It would be 4

D It would reset to 0

💡 Hint

With a higher limit, the count increments normally until the new limit is reached.

Concept Snapshot

Rate limiting in Flask uses a counter per client IP.
Each request increments the count.
If count exceeds limit (e.g., 3/min), requests are blocked.
Count resets after time window (e.g., 1 minute).
Use flask_limiter for easy setup.

Full Transcript

Rate limiting protects a Flask app by counting requests from each client IP. When a client sends a request, the server checks how many requests that client made recently. If the count is below the limit, the request is processed and the count increases. If the count reaches the limit, further requests are rejected with a 429 error until the time window resets and the count goes back to zero. This prevents clients from overwhelming the server with too many requests in a short time. The example code uses the flask_limiter library to enforce a limit of 3 requests per minute on the /data route.