Django REST Throttle Scope Fix

In this tutorial, you'll learn about Django REST Throttle Scope Fix. We cover key concepts, practical examples, and best practices.

The Problem

DRF throttle classes apply the same rate limit to all endpoints by default. When you need different limits — 100 req/hour for public endpoints, 1000 req/hour for authenticated users — scoped throttling is required.

Quick Fix

Wrong — single global throttle

# settings.py
REST_FRAMEWORK = {
    'DEFAULT_THROTTLE_CLASSES': [
        'rest_framework.throttling.AnonRateThrottle',
    ],
    'DEFAULT_THROTTLE_RATES': {
        'anon': '10/hour',
    }
}

Output: The same 10/hour limit applies to every endpoint, including login, search, and reports.

Correct — scoped throttling

# settings.py
REST_FRAMEWORK = {
    'DEFAULT_THROTTLE_CLASSES': [
        'rest_framework.throttling.ScopedRateThrottle',
    ],
    'DEFAULT_THROTTLE_RATES': {
        'uploads': '20/hour',
        'search': '100/minute',
        'reports': '5/hour',
    }
}

# views.py
class FileUploadView(APIView):
    throttle_scope = 'uploads'
    ...

class SearchView(APIView):
    throttle_scope = 'search'
    ...

Output: Each endpoint uses its configured rate limit.

Custom throttle scope on ViewSet action

class DataViewSet(viewsets.ModelViewSet):
    @action(detail=False, methods=['get'], throttle_scope='search')
    def search(self, request):
        ...

    @action(detail=False, methods=['post'], throttle_scope='uploads')
    def import_csv(self, request):
        ...

Per-user throttling

class CustomRateThrottle(UserRateThrottle):
    def get_cache_key(self, request, view):
        if request.user.is_authenticated:
            return f"user_{request.user.id}_{view.throttle_scope}"
        return super().get_cache_key(request, view)

Prevention

• Use ScopedRateThrottle when different endpoints need different limits.
• Set throttle_scope on each view or action.
• Test throttling with manage.py or by hitting the endpoint 10+ times.

Common Mistakes with rest throttle scope

1. Mixing let bindings with <- bindings in do notation, producing type errors
2. Overlapping type class instances that cause GHC to reject the program with ambiguous dispatch errors
3. Non-exhaustive pattern matches that compile with warnings then crash at runtime

These mistakes appear frequently in real-world DJANGO code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ