Rate limiting in Ruby on Rails - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens when a user exceeds the rate limit in Rails with Rack::Attack?

Consider a Rails app using Rack::Attack to limit requests to 5 per minute per IP. What is the typical response when a user exceeds this limit?

Ruby on Rails

class Rack::Attack
  throttle('req/ip', limit: 5, period: 1.minute) do |req|
    req.ip
  end
end

A The server responds with HTTP status 500 Internal Server Error.

B The server queues the request and processes it later.

C The server responds with HTTP status 429 Too Many Requests.

D The server ignores the limit and processes the request normally.

💡 Hint

Think about the standard HTTP status code for too many requests.

Rack::Attack returns HTTP 429 status code when the request limit is exceeded, signaling the client to slow down.

📝 Syntax

intermediate

Identify the correct syntax to throttle requests by user ID in Rack::Attack

Which of the following code snippets correctly throttles requests to 10 per minute per user ID in a Rails app using Rack::Attack?

A throttle('req/user', limit: 10, period: 1.minute) { |req| req.session[:user_id] }

B throttle('req/user', limit: 10, period: 1.minute) { |req| req.user_id }

C throttle('req/user', limit: 10, period: 1.minute) { |req| req.user.id }

D throttle('req/user', limit: 10, period: 1.minute) { |req| req.params[:user_id] }

💡 Hint

Remember that Rack::Attack works on the Rack request object, which has params but not user methods.

Rack::Attack's block receives a Rack::Request object, which has access to params. Using req.params[:user_id] correctly extracts the user ID for throttling.

🔧 Debug

advanced

Why does this Rack::Attack throttle not work as expected?

Given this code snippet, users are not being throttled correctly. What is the most likely cause? class Rack::Attack throttle('logins/ip', limit: 5, period: 20.seconds) do |req| if req.path == '/login' && req.post? req.ip end end end

Ruby on Rails

class Rack::Attack
  throttle('logins/ip', limit: 5, period: 20.seconds) do |req|
    if req.path == '/login' && req.post?
      req.ip
    end
  end
end

A The condition returns nil for non-login requests, causing Rack::Attack to count them incorrectly.

B The throttle block should always return a string, but req.ip returns an integer.

C The throttle period is too short to trigger throttling.

D The throttle name 'logins/ip' is invalid and causes the throttle to be ignored.

💡 Hint

Think about what happens when the block returns nil for some requests.

If the block returns nil, Rack::Attack ignores that request for throttling. Returning nil for non-login requests is expected and does not cause counting issues. However, if the condition is incorrect or the path check is wrong, it might cause unexpected behavior.

🧠 Conceptual

advanced

What is the main benefit of using Redis with Rack::Attack for rate limiting?

Why do many Rails apps use Redis as the cache store for Rack::Attack when implementing rate limiting?

A Redis automatically blocks IPs without any configuration.

B Redis provides fast, centralized storage to track request counts across multiple app servers.

C Redis encrypts all request data for security.

D Redis replaces the need for Rack::Attack middleware.

💡 Hint

Think about how multiple servers share state for rate limiting.

Redis is a fast in-memory store that allows multiple app instances to share request count data, enabling consistent rate limiting across servers.

❓ state_output

expert

What is the value of the counter after 3 requests from the same IP in 1 minute with this Rack::Attack throttle?

Given this throttle configuration, what is the value stored in the cache for the key 'rack::attack:throttle:logins/ip:1.2.3.4' after 3 POST requests to '/login' from IP '1.2.3.4' within 1 minute? class Rack::Attack throttle('logins/ip', limit: 5, period: 60.seconds) do |req| req.ip if req.path == '/login' && req.post? end end

Ruby on Rails

class Rack::Attack
  throttle('logins/ip', limit: 5, period: 60.seconds) do |req|
    req.ip if req.path == '/login' && req.post?
  end
end

A 3

B 5

C 0

D nil

💡 Hint

Each matching request increments the counter by 1.

Each POST request to '/login' from the same IP increments the counter by 1. After 3 such requests, the counter value is 3.