Per-user vs per-IP limits in Rest API - Interactive Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to check the user's ID for rate limiting.

Rest API

if request.user.id == [1]:
    allow_request()

Drag options to blanks, or click blank then click option'

A12345

Buser_id

Crequest.ip

Drequest.user.id

Attempts:

3 left

💡 Hint

Common Mistakes

Using a fixed number instead of the dynamic user ID.

Confusing IP address with user ID.

We compare the user ID from the request to itself to check the current user.

2fill in blank

medium

Complete the code to extract the IP address from the request headers.

Rest API

ip_address = request.headers.get([1])

Drag options to blanks, or click blank then click option'

A'X-Forwarded-For'

B'User-Agent'

C'Authorization'

D'Content-Type'

Attempts:

3 left

💡 Hint

Common Mistakes

Using unrelated headers like 'User-Agent' or 'Authorization'.

Not using quotes around the header name.

The 'X-Forwarded-For' header usually contains the client's IP address behind proxies.

3fill in blank

hard

Fix the error in the rate limit check comparing IP addresses.

Rest API

if request.ip == [1]:
    block_request()

Drag options to blanks, or click blank then click option'

Arequest.user.id

Brequest.ip

Crequest.headers.get('X-Forwarded-For')

Duser_ip

Attempts:

3 left

💡 Hint

Common Mistakes

Comparing IP to user ID.

Using request.ip directly without checking headers.

To compare IP addresses correctly, use the IP from headers like 'X-Forwarded-For'.

4fill in blank

hard

Fill both blanks to create a dictionary comprehension that maps user IDs to their request counts if the count is greater than 5.

Rest API

user_limits = {user.id: requests[1] for user, requests in user_requests.items() if requests [2] 5}

Drag options to blanks, or click blank then click option'

A* 2

B>

C>=

D+ 1

Attempts:

3 left

💡 Hint

Common Mistakes

Using multiplication instead of addition for counts.

Using '>=' instead of '>' which changes the filter condition.

We add 1 to requests for the value, and filter users with requests greater than 5.

5fill in blank

hard

Fill all three blanks to create a dictionary comprehension that maps IP addresses to user IDs only if the user is active and the IP is not empty.

Rest API

ip_user_map = {request.headers.get([1]): user.id for user, request in requests.items() if user.active == [2] and request.headers.get([3]) != ''}

Drag options to blanks, or click blank then click option'

A'X-Forwarded-For'

BTrue

C'Remote-Addr'

DFalse

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing up header names for IP addresses.

Using False instead of True for active user check.

We get IP from 'X-Forwarded-For', check if user is active (True), and ensure 'Remote-Addr' header is not empty.

Practice

1. What is the main difference between per-user and per-IP rate limits in REST APIs?

easy

A. Per-user limits block IP addresses; per-IP limits block user accounts.

B. Per-user limits count requests from each IP; per-IP limits count requests from each user.

C. Per-user limits track requests by user identity; per-IP limits track requests by the requester's IP address.

D. Per-user limits apply only to logged-out users; per-IP limits apply only to logged-in users.

Solution

1. Step 1: Understand per-user limits

   Per-user limits count how many requests each user (identified by login or token) makes.

2. Step 2: Understand per-IP limits

   Per-IP limits count requests based on the IP address making the request, regardless of user identity.

3. Final Answer:

   Per-user limits track requests by user identity; per-IP limits track requests by the requester's IP address. -> Option C

4. Quick Check:

   Per-user = user identity, Per-IP = IP address [OK]

Hint: User limits track users; IP limits track locations [OK]

Common Mistakes:

• Confusing user identity with IP address
• Thinking per-IP limits block users
• Assuming per-user limits apply only to logged-out users

2. Which of the following is the correct way to check a per-user rate limit in pseudocode?

easy

A. if requests_from_user > limit: block_request()

B. if requests_from_ip > limit: block_request()

C. if user_ip == limit: block_request()

D. if user == limit: block_request()

Solution

1. Step 1: Identify per-user check

   Per-user limits check how many requests a user has made, so the condition should compare requests_from_user to the limit.

2. Step 2: Verify correct syntax

   The correct syntax is to compare requests_from_user > limit and block if true.

3. Final Answer:

   if requests_from_user > limit: block_request() -> Option A

4. Quick Check:

   Check user requests count > limit [OK]

Hint: Per-user means check requests_from_user variable [OK]

Common Mistakes:

• Using IP variable for per-user limit
• Comparing user or IP directly to limit
• Using equality instead of greater than

3. Given this pseudocode snippet for rate limiting:

requests_per_user = {"alice": 5, "bob": 3}
requests_per_ip = {"192.168.1.1": 10, "10.0.0.2": 2}
user = "alice"
ip = "192.168.1.1"
user_limit = 5
ip_limit = 10

if requests_per_user[user] >= user_limit:
    print("User limit reached")
elif requests_per_ip[ip] >= ip_limit:
    print("IP limit reached")
else:
    print("Request allowed")

What will be printed?

medium

A. Request allowed

B. User limit reached

C. IP limit reached

D. Error: Key not found

Solution

1. Step 1: Check user request count

   requests_per_user["alice"] is 5, which is equal to user_limit (5), so the first if condition is true.

2. Step 2: Determine which print runs

   Since the first condition is true, it prints "User limit reached" and skips the rest.

3. Final Answer:

   User limit reached -> Option B

4. Quick Check:

   5 >= 5 triggers user limit [OK]

Hint: Check user count first; equal means limit reached [OK]

Common Mistakes:

• Thinking IP limit triggers first
• Ignoring >= condition
• Assuming else runs when equal

4. This code snippet is intended to enforce per-IP rate limits but has a bug:

requests_per_ip = {"1.2.3.4": 8}
ip_limit = 10
ip = "1.2.3.4"

if requests_per_ip[ip] > ip_limit:
    print("Limit exceeded")
else:
    print("Allowed")

What is the bug and how to fix it?

medium

A. Bug: Uses > instead of >=; fix by changing to >=.

B. Bug: ip variable is wrong type; fix by converting to string.

C. Bug: requests_per_ip key missing; fix by adding default value.

D. Bug: prints wrong message; fix by swapping print statements.

Solution

1. Step 1: Analyze condition logic

   The code blocks requests only if requests_per_ip[ip] > ip_limit, so if requests equal ip_limit, it allows the request.

2. Step 2: Fix condition to include equal case

   Change > to >= so requests equal to ip_limit also get blocked.

3. Final Answer:

   Bug: Uses > instead of >=; fix by changing to >=. -> Option A

4. Quick Check:

   Use >= to block at limit [OK]

Hint: Use >= to block requests at limit, not just above [OK]

Common Mistakes:

• Ignoring equal case in condition
• Assuming IP variable type is wrong
• Thinking missing keys cause this bug

5. You want to implement a rate limiter that blocks requests if either the user or the IP address exceeds their limits. Which pseudocode correctly enforces this combined rule?

hard

A. if requests_per_user[user] > user_limit and requests_per_ip[ip] > ip_limit:
block_request()

B. if requests_per_user[user] == user_limit and requests_per_ip[ip] == ip_limit:
block_request()

C. if requests_per_user[user] < user_limit or requests_per_ip[ip] < ip_limit:
block_request()

D. if requests_per_user[user] > user_limit or requests_per_ip[ip] > ip_limit:
block_request()

Solution

1. Step 1: Understand combined blocking logic

   The request should be blocked if either the user or the IP exceeds their limit, so the condition must use OR.

2. Step 2: Check condition correctness

   if requests_per_user[user] > user_limit or requests_per_ip[ip] > ip_limit: block_request() uses OR with > comparisons, correctly blocking if user or IP exceeds limits.

3. Final Answer:

   if requests_per_user[user] > user_limit or requests_per_ip[ip] > ip_limit: block_request() -> Option D

4. Quick Check:

   Block if user OR IP exceeds limit [OK]

Hint: Use OR to block if either user or IP exceeds limit [OK]

Common Mistakes:

• Using AND instead of OR
• Using < instead of >
• Checking equality only