Throttling specific parts of the API with multiple rates

[voxvici]

There doesn't seem a way to set

rate = '6/minute'
rate = '10/day'

for part of API, there is an example to do it globally, but how to do it for a specific part of API?

I've been playing with throttle code and it would be nice to have a function to check if the scope is blocked also another part that doesn't make sense is that if there are two throttle classes inside API view and the higher one will keep getting added into cache even tough the smaller throttle is blocked and not returning results.

[realsuayip]

See:
https://www.django-rest-framework.org/api-guide/throttling/

You can also set the throttling policy on a per-view or per-viewset basis, using the APIView class-based views.

from rest_framework.response import Response
from rest_framework.throttling import UserRateThrottle
from rest_framework.views import APIView

class ExampleView(APIView):
    throttle_classes = [UserRateThrottle]

    def get(self, request, format=None):
        content = {
            'status': 'request was permitted'
        }
        return Response(content)

If you're using the @api_view decorator with function based views you can use the following decorator.

@api_view(['GET'])
@throttle_classes([UserRateThrottle])
def example_view(request, format=None):
    content = {
        'status': 'request was permitted'
    }
    return Response(content)

[voxvici]

that works fine but having multiple throttle classes doesn't work, if you set a max limit per day and max limit per minute/hour for anything less than a day it doesn't work, once smaller throttle is blocked higher one will keep adding blocked requests as if they passed through. I haven't tested global ScopedRateThrottle and if it has the same issue

[hashlash]

From what I see, you're trying to ask 3 different questions (cmiiw):

How to set different rates for different views?

Yes, there are two approaches I can think of:

• Create custom throttles with different rates and set it on per-view or per-viewset basis, like @realsuayip mentioned.

• Use ScopedRateThrottle (you can set it as the default throttle class or set it on per-view or per-viewset basis). With this, you can define each scope rate and use it accordingly on each of your views.

How to check if the scope is blocked?

You can instantiate the throttle and call the .allow_request() method with the request and the view as its arguments.

If you're searching for a way to check it outside the view lifecycle, I'm afraid you must implement your own function.

Something doesn't make sense

Your argument:

... another part that doesn't make sense is that if there are two throttle classes inside API view and the higher one will keep getting added into cache even tough the smaller throttle is blocked and not returning results.

I also found it quite weird. Perhaps the other can explain it?

[voxvici]

thank you for the answer, yes it became multiple questions because I wasn't sure if I am missing something or it's a bug when you have multiple throttle classes

[hashlash]

@voxvici So your main problem is about the strange behavior when having multiple throttle classes in a view, right?

In that case, I suggest you edit the title (and perhaps the description) to point out your main concern. And since it seems to be an unintended behavior, I think it's better to move this discussion to the Potential Issue category.

[voxvici]

@hashlash will do, thank you wasn't sure if it was desired behavior of throttles

[voxvici]

class MinRateThrottle(UserRateThrottle):
    rate = '3/minute'

class MaxRateThrottle(UserRateThrottle):
    rate = '10/day'

throttle_classes = [MinRateThrottle, MaxRateThrottle]

same issue when throttle has a scope (if there are two throttle classes inside API view and the higher one will keep getting added into cache even though the smaller throttle is blocked and not returning results)