Per-user vs per-IP limits in Rest API - Quick Revision & Key Differences

Recall & Review

beginner

What is a per-user limit in API rate limiting?

A per-user limit restricts the number of API requests a single user can make within a certain time frame, regardless of their IP address.

beginner

What does a per-IP limit control in API usage?

A per-IP limit restricts the number of API requests coming from a single IP address within a set time, regardless of how many users share that IP.

intermediate

Why might per-user limits be better for APIs with logged-in users?

Because they track individual users, per-user limits prevent one user from overusing the API even if they switch IPs, ensuring fair use among users.

intermediate

What is a downside of using only per-IP limits?

If many users share the same IP (like in offices or public Wi-Fi), they might hit the limit quickly, blocking legitimate users unfairly.

advanced

How can combining per-user and per-IP limits improve API security?

Combining both limits helps stop abuse from single users and from many requests coming from one IP, balancing fairness and protection.

What does a per-user limit track in API rate limiting?

A Total requests from all users

B Requests from a single IP address

C Individual user requests regardless of IP

D Requests from a specific device type

Per-user limits count requests made by each user, no matter which IP they use.

Which scenario is a disadvantage of per-IP limits?

A Users sharing the same IP get blocked too soon

B Users can switch IPs to bypass limits

C Limits are too strict for individual users

D Limits do not apply to logged-in users

When many users share one IP, per-IP limits can block them unfairly.

Why might an API use per-user limits instead of per-IP limits?

A To block all requests from an IP

B To track individual user activity accurately

C To allow unlimited requests from users

D To ignore user authentication

Per-user limits focus on individual users, not IP addresses.

What is a benefit of combining per-user and per-IP limits?

A Better protection against abuse from users and IPs

B Allows unlimited requests from all users

C Blocks all users from the same IP

D Removes the need for authentication

Combining limits helps stop abuse both from single users and from many requests from one IP.

If a user changes their IP address, which limit still controls their API usage?

A Neither limit

B Per-IP limit

C Both limits stop working

D Per-user limit

Per-user limits track the user regardless of IP changes.

Explain the difference between per-user and per-IP limits in API rate limiting.

Think about who or what is being tracked for limiting requests.

Describe why combining per-user and per-IP limits can be more effective than using just one.

Consider different ways users and IPs can be abused.