Hardening, Health, and Rate Limits
Scenario
A malicious user writes a script to hit your login endpoint 10,000 times a second. Your database gets overwhelmed, and the entire platform goes down for everyone.
Mental model
Hardening an API is like building a castle. CORS is the drawbridge (who can enter from a browser). Rate limiting is the turnstile (how fast they can enter). Health checks are the flag on the tower signaling the castle is functional.
Deep dive
Before going to production, an API needs protective boundaries.
A Health Check is a simple `/health` endpoint that returns a 200 OK. Load balancers (like AWS ALB or Kubernetes) ping this constantly to know if the container is alive or needs to be restarted.
Rate Limiting prevents abuse (DDoS or scraping). It tracks the number of requests per IP or user over a time window and returns a `429 Too Many Requests` if the limit is exceeded.
Code examples
Bad: Global CORS with Credentials
from fastapi.middleware.cors import CORSMiddleware
app.add_middleware(
CORSMiddleware,
allow_origins=["*"],
allow_credentials=True,
allow_methods=["*"],
)This is a massive security flaw. Allowing credentials (cookies/auth) with a wildcard origin allows any malicious website to impersonate users via CSRF.
Good: Specific CORS and Health Check
app.add_middleware(
CORSMiddleware,
allow_origins=["https://myapp.com"],
allow_credentials=True,
allow_methods=["*"],
)
@app.get("/health")
def health_check():
# Optionally verify DB connection here
return {"status": "ok"}CORS is strictly limited to the frontend domain. The health check allows the load balancer to monitor the service.
Common mistakes
- Doing heavy work in a health check: If your `/health` endpoint queries 5 external services, a failure in one non-critical service might cause the load balancer to kill the container, taking the whole app down. Keep health checks lightweight.
Recall questions
- What HTTP status code is returned when a client exceeds a rate limit?
- Why must `allow_origins` not be `["*"]` when `allow_credentials=True`?
- What is the purpose of a `/health` endpoint?
Questions & answers
How do you implement rate limiting in a distributed system with multiple worker processes?
You must use a centralized in-memory store like Redis. If you use local memory, each worker or container will have its own counter, allowing the user to bypass the limit.
What is the difference between Authentication and Rate Limiting, and which happens first?
Rate limiting (often per IP) usually happens first to prevent volumetric attacks before the server spends CPU verifying passwords or JWTs. Authentication proves identity; rate limiting restricts volume.