Per-user vs per-IP limits in Rest API - Practice Questions

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Rate Limits: Per-User vs Per-IP

In a REST API, what is the main difference between applying rate limits per user and per IP address?

A Per-user limits apply only to authenticated users, while per-IP limits apply only to unauthenticated users.

B Per-user limits restrict requests based on user identity, while per-IP limits restrict requests based on the client IP address.

C Per-user limits restrict requests based on IP address, while per-IP limits restrict requests based on user identity.

D Per-user limits allow unlimited requests, while per-IP limits always block after one request.

💡 Hint

Think about what uniquely identifies a user versus what identifies a network location.

Per-user limits track requests by user identity (like a user ID), so each user has their own quota. Per-IP limits track requests by the IP address of the client, so all requests from that IP share the quota.

❓ Predict Output

intermediate

Output of Rate Limit Check Function

Given this Python function that checks rate limits, what will be the output when calling check_limit('user123', '192.168.1.10') if the user has made 5 requests and the IP has made 10 requests?

Rest API

def check_limit(user_id, ip):
    user_limit = 5
    ip_limit = 10
    user_requests = {'user123': 5}
    ip_requests = {'192.168.1.10': 10}
    if user_requests.get(user_id, 0) >= user_limit:
        return 'User limit exceeded'
    if ip_requests.get(ip, 0) >= ip_limit:
        return 'IP limit exceeded'
    return 'Allowed'

A KeyError

B "IP limit exceeded"

C "Allowed"

D "User limit exceeded"

💡 Hint

Check which limit is reached first in the code.

The function first checks if the user has reached their limit. Since user123 has 5 requests which equals the limit, it returns 'User limit exceeded' before checking the IP.

🔧 Debug

advanced

Identify the Bug in Rate Limiting Logic

What error will this code raise when calling increment_request('user1', '10.0.0.1') for the first time?

Rest API

user_requests = {}
ip_requests = {}
user_limit = 3
ip_limit = 5

def increment_request(user_id, ip):
    if user_requests[user_id] >= user_limit:
        return 'User limit reached'
    if ip_requests[ip] >= ip_limit:
        return 'IP limit reached'
    user_requests[user_id] += 1
    ip_requests[ip] += 1
    return 'Request allowed'

A KeyError

B TypeError

C ValueError

D No error, returns 'Request allowed'

💡 Hint

Think about what happens when you try to access a dictionary key that does not exist.

Since the dictionaries are empty, trying to access user_requests[user_id] or ip_requests[ip] before initializing them causes a KeyError.

📝 Syntax

advanced

Syntax Error in Rate Limit Decorator

Which option contains the correct syntax for a Python decorator that limits API calls per user?

Rest API

def rate_limit(func):
    def wrapper(user_id):
        # limit logic here
        return func(user_id)
    return wrapper

A

def rate_limit(func):
    def wrapper(user_id):
        # limit logic
        return func(user_id)
    return wrapper

B

def rate_limit(func):
    def wrapper(user_id):
        # limit logic
        return func(user_id)
    wrapper

C

def rate_limit(func):
    def wrapper(user_id):
        # limit logic
        return func(user_id)
    return wrapper()

D

def rate_limit(func):
    def wrapper(user_id):
        # limit logic
        return func(user_id)
    return func

💡 Hint

Remember what a decorator must return.

A decorator must return the inner wrapper function itself, not call it or return the original function.

🚀 Application

expert

Choosing Rate Limit Strategy for a Public API

You manage a public REST API used by many anonymous users behind shared IP addresses. Which rate limiting strategy is best to prevent abuse while minimizing false blocks?

A Apply per-user limits only, ignoring IP addresses since users are anonymous.

B Apply strict per-IP limits only, blocking IPs after few requests.

C Combine per-IP limits with a higher threshold and per-user limits for authenticated users.

D Do not apply any rate limits to avoid blocking legitimate users.

💡 Hint

Consider how anonymous users and shared IPs affect rate limiting.

Since many users share IPs, strict per-IP limits can block many legitimate users. Combining per-IP limits with higher thresholds and per-user limits for authenticated users balances protection and usability.

Practice

1. What is the main difference between per-user and per-IP rate limits in REST APIs?

easy

A. Per-user limits block IP addresses; per-IP limits block user accounts.

B. Per-user limits count requests from each IP; per-IP limits count requests from each user.

C. Per-user limits track requests by user identity; per-IP limits track requests by the requester's IP address.

D. Per-user limits apply only to logged-out users; per-IP limits apply only to logged-in users.

Solution

1. Step 1: Understand per-user limits

   Per-user limits count how many requests each user (identified by login or token) makes.

2. Step 2: Understand per-IP limits

   Per-IP limits count requests based on the IP address making the request, regardless of user identity.

3. Final Answer:

   Per-user limits track requests by user identity; per-IP limits track requests by the requester's IP address. -> Option C

4. Quick Check:

   Per-user = user identity, Per-IP = IP address [OK]

Hint: User limits track users; IP limits track locations [OK]

Common Mistakes:

• Confusing user identity with IP address
• Thinking per-IP limits block users
• Assuming per-user limits apply only to logged-out users

2. Which of the following is the correct way to check a per-user rate limit in pseudocode?

easy

A. if requests_from_user > limit: block_request()

B. if requests_from_ip > limit: block_request()

C. if user_ip == limit: block_request()

D. if user == limit: block_request()

Solution

1. Step 1: Identify per-user check

   Per-user limits check how many requests a user has made, so the condition should compare requests_from_user to the limit.

2. Step 2: Verify correct syntax

   The correct syntax is to compare requests_from_user > limit and block if true.

3. Final Answer:

   if requests_from_user > limit: block_request() -> Option A

4. Quick Check:

   Check user requests count > limit [OK]

Hint: Per-user means check requests_from_user variable [OK]

Common Mistakes:

• Using IP variable for per-user limit
• Comparing user or IP directly to limit
• Using equality instead of greater than

3. Given this pseudocode snippet for rate limiting:

requests_per_user = {"alice": 5, "bob": 3}
requests_per_ip = {"192.168.1.1": 10, "10.0.0.2": 2}
user = "alice"
ip = "192.168.1.1"
user_limit = 5
ip_limit = 10

if requests_per_user[user] >= user_limit:
    print("User limit reached")
elif requests_per_ip[ip] >= ip_limit:
    print("IP limit reached")
else:
    print("Request allowed")

What will be printed?

medium

A. Request allowed

B. User limit reached

C. IP limit reached

D. Error: Key not found

Solution

1. Step 1: Check user request count

   requests_per_user["alice"] is 5, which is equal to user_limit (5), so the first if condition is true.

2. Step 2: Determine which print runs

   Since the first condition is true, it prints "User limit reached" and skips the rest.

3. Final Answer:

   User limit reached -> Option B

4. Quick Check:

   5 >= 5 triggers user limit [OK]

Hint: Check user count first; equal means limit reached [OK]

Common Mistakes:

• Thinking IP limit triggers first
• Ignoring >= condition
• Assuming else runs when equal

4. This code snippet is intended to enforce per-IP rate limits but has a bug:

requests_per_ip = {"1.2.3.4": 8}
ip_limit = 10
ip = "1.2.3.4"

if requests_per_ip[ip] > ip_limit:
    print("Limit exceeded")
else:
    print("Allowed")

What is the bug and how to fix it?

medium

A. Bug: Uses > instead of >=; fix by changing to >=.

B. Bug: ip variable is wrong type; fix by converting to string.

C. Bug: requests_per_ip key missing; fix by adding default value.

D. Bug: prints wrong message; fix by swapping print statements.

Solution

1. Step 1: Analyze condition logic

   The code blocks requests only if requests_per_ip[ip] > ip_limit, so if requests equal ip_limit, it allows the request.

2. Step 2: Fix condition to include equal case

   Change > to >= so requests equal to ip_limit also get blocked.

3. Final Answer:

   Bug: Uses > instead of >=; fix by changing to >=. -> Option A

4. Quick Check:

   Use >= to block at limit [OK]

Hint: Use >= to block requests at limit, not just above [OK]

Common Mistakes:

• Ignoring equal case in condition
• Assuming IP variable type is wrong
• Thinking missing keys cause this bug

5. You want to implement a rate limiter that blocks requests if either the user or the IP address exceeds their limits. Which pseudocode correctly enforces this combined rule?

hard

A. if requests_per_user[user] > user_limit and requests_per_ip[ip] > ip_limit:
block_request()

B. if requests_per_user[user] == user_limit and requests_per_ip[ip] == ip_limit:
block_request()

C. if requests_per_user[user] < user_limit or requests_per_ip[ip] < ip_limit:
block_request()

D. if requests_per_user[user] > user_limit or requests_per_ip[ip] > ip_limit:
block_request()

Solution

1. Step 1: Understand combined blocking logic

   The request should be blocked if either the user or the IP exceeds their limit, so the condition must use OR.

2. Step 2: Check condition correctness

   if requests_per_user[user] > user_limit or requests_per_ip[ip] > ip_limit: block_request() uses OR with > comparisons, correctly blocking if user or IP exceeds limits.

3. Final Answer:

   if requests_per_user[user] > user_limit or requests_per_ip[ip] > ip_limit: block_request() -> Option D

4. Quick Check:

   Block if user OR IP exceeds limit [OK]

Hint: Use OR to block if either user or IP exceeds limit [OK]

Common Mistakes:

• Using AND instead of OR
• Using < instead of >
• Checking equality only